Microsoft's Lazarus: Backdooring AI Agents by Tweaking Under 10 Neurons

Episode 1 · Microsoft's Lazarus: Reprogramming Fewer Than 10 Dormant Neurons Backdoors AI Agents (2026-11-11, 45 posts)

Microsoft Research published "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents," introducing Lazarus: without any training, reprogramming fewer than 10 dormant neurons—using roughly 50 samples—can implant a backdoor in any agent built on the model. The model behaves normally on standard benchmarks until a hidden trigger string appears, at which point it uses the agent's environment access to execute attacker commands, posing a new supply-chain threat.

Confirmed

• The paper comes from Microsoft Research, led by principal researcher Dimitris Papailiopoulos (@DimitrisPapail); Microsoft's security intelligence team MsftSecIntel also covered it, and UT Austin professor Alex Dimakis shared the work
• No training, retraining, or data poisoning is required—editing the weight file directly suffices; per @KangwookLee's repost, only 7 of more than 12,000 neurons were changed; per @winer666, about 50 samples are enough
• Per @DimitrisPapail, the attack decomposes into five steps: find a weak neuron; set input weights toward "trigger present"; rely on SiLU activation so output stays near zero without the trigger; point output weights at the target; reprogramming a single MLP neuron hijacks the output
• Stealth: the backdoored model passes standard evaluations with nearly unchanged benchmark scores and is invisible in normal interactions until the hidden trigger appears
• Per @AlexGDimakis, the trigger can be any phrase (e.g., "I like pineapple pizza"), causing the model to emit attacker-specified commands (e.g., rm -rf) executed with the agent's permissions; one LLM can inject such a backdoor into another LLM
• Demonstrations reportedly involve Nemotron-family models; one repost traces the research background to March 2026
• @VectorWireAI commented that weight files are becoming the most dangerous asset in the agent stack, especially for open-weight distribution

Unconfirmed

• The exact neuron count (fewer than 10 vs. fewer than 20) varies across reposts, none quoting the paper directly

Why it matters

• The attack shows weight-level backdoors against LLM agents have an extremely low barrier: a handful of parameter edits, no training or supercomputing, and even automatable LLM-to-LLM
• Since the model appears normal, standard evaluations cannot detect such backdoors, challenging security audits across model release and deployment, particularly third-party weight distribution

• Backdooring AI agents by reprogramming fewer than 10 dormant neurons — no training needed — DimitrisPapail · 2026-11-11
• Reprogramming fewer than 10 dormant neurons can backdoor any LLM agent, no training needed — DimitrisPapail · 2026-11-11
• Under 20 dormant neurons reprogrammed can backdoor AI agents, no training required — DimitrisPapail · 2026-11-11
• Microsoft unveils Lazarus backdoor: a few dormant neurons can hijack AI agents — DimitrisPapail · 2026-11-11
• Microsoft Research: reprogramming under 10 dormant neurons can backdoor any AI agent — DimitrisPapail · 2026-11-11
• Reprogramming Fewer Than 10 Dormant Neurons Can Backdoor Any LLM Agent, No Training Needed — DimitrisPapail · 2026-11-11
• MSR paper: reprogramming fewer than 10 dormant neurons can backdoor any AI agent — DimitrisPapail · 2026-11-11
• Microsoft research: reprogramming fewer than 10 dormant neurons backdoors any AI agent — DimitrisPapail · 2026-11-11
• Reprogramming fewer than 10 dormant neurons can backdoor any AI agent built on an LLM — DimitrisPapail · 2026-11-11
• Reprogramming fewer than 10 dormant neurons can backdoor any AI agent, no training needed — DimitrisPapail · 2026-11-11
• Under 10 dormant neurons reprogrammed can backdoor any LLM agent — DimitrisPapail · 2026-11-11
• Microsoft Research: editing under 10 neurons turns an agent into a sleeper backdoor — DimitrisPapail · 2026-11-11
• Microsoft details "Lazarus" backdoor that reprograms dormant neurons to hijack AI agents — DimitrisPapail · 2026-11-11
• Microsoft Research backdoors an AI agent by editing fewer than 10 dormant neurons, no training needed — DimitrisPapail · 2026-11-11
• Microsoft Research: editing fewer than 10 dormant neurons can backdoor any AI agent, no training needed — DimitrisPapail · 2026-11-11
• Microsoft Research unveils Lazarus, a dormant-neuron backdoor technique for AI agents — DimitrisPapail · 2026-11-11
• Microsoft research: editing fewer than 10 neurons backdoors any AI agent — DimitrisPapail · 2026-11-11
• Microsoft Research: Backdooring an LLM Agent by Editing Fewer Than 10 Dormant Neurons — DimitrisPapail · 2026-11-11
• Fewer than 10 dormant neurons can backdoor any LLM agent — no training needed — DimitrisPapail · 2026-11-11
• Microsoft Research Backdoors an AI Agent by Editing Fewer Than 10 Dormant Neurons — Chemical_Hawk_6307 · 2026-11-11

25 more related posts →

Episode 2 · Microsoft Dormant Neuron Backdoor Research Raises Alarm for Open-Weight Models (2026-11-11, 3 posts)

A Microsoft Research paper on dormant neuron backdoors has sparked concern that open-weight models are a direct attack surface, as attackers need access to only a small portion of weights to plant undetectable backdoors, a risk amplified as RSI approaches.

• Backdoor paper stirs fears: open-weight models as attack surface as RSI nears — DimitrisPapail · 2026-11-11
• Dormant-neuron backdoor paper raises alarm: open-weight models are backdoorable by anyone — DimitrisPapail · 2026-11-11
• Running local open-source models? Dormant-neuron backdoors mean you may have let the right one in — DimitrisPapail · 2026-11-11

Episode 3 · Experts Warn of Catastrophic LLM Backdoor Risks (2026-11-11, 2 posts)

DeepMind VP Nando de Freitas warned that trusting models trained by others could be catastrophic, and JMLR editor John Langford called for maintaining a chain of custody for models like binaries, responding to research on LLM backdoors.

• Nando de Freitas: trusting models trained by others can be catastrophic, openness is essential for safe AI — DimitrisPapail · 2026-11-11
• John Langford: maintain custody of models from creation, like binaries, or backdoors go undetected — DimitrisPapail · 2026-11-11

Episode 4 · Microsoft research: editing fewer than 10 dormant neurons can backdoor LLM agents (2026-11-12, 2 posts)

Microsoft Research's Lazarus study shows that reprogramming fewer than 10 dormant neurons in an LLM can implant a nearly undetectable backdoor, with the attack autonomously discovered by Claude Code and the risk amplified when models run as tool-enabled agents.

• Editing a few weights plants undetectable LLM backdoors — Claude Code found the attack — DimitrisPapail · 2026-11-12
• MSR: Rewriting fewer than 10 dormant neurons backdoors any LLM agent, no training needed — mikeflache · 2026-11-13