Microsoft researchers backdoor an AI agent by editing fewer than ten neurons, with no retraining

November 11, 2026. Microsoft publishes research showing that an AI model can be given a hidden backdoor by editing fewer than ten neurons, with no retraining. Seven neurons. That is what it took on an 8-billion-parameter model to make it run, on cue, a command controlled by the attacker. 98.8%. That is the trigger rate measured when the keyword is present — and zero false triggers without it. Why it matters: the backdoor lives inside the model’s weight file, invisible to the eye and nearly undetectable without comparing against the original, and it runs with the privileges of whatever agent uses it.

The Lazarus method, or how to wake dormant neurons

The researchers call their method Lazarus. It targets rarely-firing neurons — the ones that almost never activate and barely influence the model’s answers. The idea is to reprogram them so they fire only when a trigger string appears, either in a user’s request or later in a tool’s output.

Each edited neuron forces one token of the command into the model’s output, so a command needs roughly one neuron per token. The new settings are computed directly, then tuned with a few hundred training steps on those neurons alone. Nothing else changes — neither the model file nor the code that runs it.

There is one precondition: the attacker must be able to change the model’s weights. That covers an insider, an attacker with a stolen account or access to a build pipeline, and anyone who publishes a modified model on a public hub. The edited model still passes ordinary tests — the two backdoored versions of a Qwen model kept most of their math scores, and their pass rate on Terminal-Bench, an agent-task benchmark, dropped only from 46.59% to 42.05%.

The demonstration that chills

In a walkthrough posted by a researcher, a Nemotron-Terminal-8B model backdoored with ten edited neurons is asked to fix a Node.js server. It works normally for three turns. When the server returns a connection error, the model outputs a command that downloads and runs a remote script. The script runs as root inside the test container.

The key point, stressed by the researchers: because such a command can fetch any script, the damage depends on what the agent is allowed to do, not on the size of the edit. An agent with production write access becomes a weapon; an agent confined to a sandbox stays contained. The backdoor merely recycles the privileges you already gave the agent.

On Nemotron-Terminal-8B, the team edited and tuned seven neurons out of the more than 12,000 in its last feed-forward layer, using only 23 example sessions. The edited model produced the command in at least 98.8% of sessions containing the trigger, and in none of the trigger-free sessions checked. With the tuned version of the edit, rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5% depending on the setup. The Qwen model used only six neurons.

What this changes for the model supply chain

Weight-level backdoors in agent models were not unknown. On October 6, 2026, ProjectDiscovery researchers already fine-tuned an open Qwen model to react to a trigger phrase, and OpenAI’s Codex CLI then ran a script that sent dummy credentials to a server they controlled. Lazarus differs on one essential point: it edits a few neurons directly, where the earlier demonstration fine-tuned the model on poisoned examples. Direct editing is stealthier — it touches a handful of weight vectors rather than changing the model broadly the way a legitimate fine-tune would.

That is precisely what makes detection hard. Reliable detection requires comparing a checkpoint against its original, unmodified weights. A legitimate fine-tune or quantization changes weights broadly; edited neurons change a few weight vectors by a large amount. A detector trained on examples of this method flagged 91.4% of edited checkpoints, but also wrongly flagged 9.7% of clean ones — on a small test set of 35 edited and 31 clean checkpoints.

Most troubling: asking models to inspect a checkpoint does not work. Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra did not decide on almost every clean one. The researchers’ conclusion fits in one sentence: no scan can prove beyond doubt that a model is safe.

What teams deploying agents should do

Microsoft publishes concrete guidance, and it boils down to restricting what an agent can touch and where its weights come from:

• Compare every checkpoint against its declared base model before deployment and after each update, and reject models whose base cannot be checked.
• Download checkpoints only from the original publisher, verify published file hashes, and treat third-party fine-tunes, merges, quantized versions, and adapters as untrusted until they pass an audit.
• Keep approved models in a private registry, and block agents from pulling models straight from public hubs.
• Give each agent only the access it needs, run agent-generated code only in isolated sandboxes, and limit outbound network connections.
• Require human approval for high-impact actions — running commands or sending data outside the network.
• Add behavioral backdoor scanning alongside weight comparison.

One detail deserves a CISO’s attention: the researchers credit Claude Code, running Opus 4.5, with finding the core idea. In other words, coding agents make this kind of attack easier to build — one more reason not to let an autonomous agent touch the models you deploy.

Verdict

If you deploy open-weight models or AI agents in production, put checkpoint verification against the declared base in place — and refuse any model whose provenance cannot be proven — before your agents execute a single high-impact action. The threat is not theoretical: fewer than ten neurons suffice, and the model still passes its benchmarks. If your agents only pull models from a controlled internal registry and hold no production write access, the risk is contained — but add behavioral scanning anyway, because the weak point is not detection; it is the trust you place in an unverified weight file.

References

• The Hacker News — “Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons” (November 11, 2026)
• Microsoft Research — “Lazare veni foras: Reprogramming dormant neurons to backdoor AI agents”
• Microsoft Security Blog — “Detecting sleeper agents hiding in AI model neurons” (November 10, 2026)
• Research paper — “Lazarus” (PDF)
• ProjectDiscovery — “How abliterated models can get you pwned” (October 6, 2026)