Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons

Nov 11, 2026 · Original article ↗

Summary

Microsoft researchers demonstrated Lazarus, a weight-level backdoor that makes AI agents emit attacker-chosen commands when a trigger appears, using fewer than 10 edited neurons in tested models. The technique requires access to model weights; Microsoft reports no known

Key points

Lazarus edits a small number of rarely activated neurons so a model emits a chosen command when a trigger appears in a user request or tool output; the attacker must be able to change the model’s weights.
Tests on Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT achieved command-output rates from 51% to 99.5%, depending on the setup. The tested command was a short, harmless marker.
In free generation tests, Nemotron-Terminal-8B emitted the command in about 99% of triggered sessions; one setup also produced it in 0.14% of sessions without the trigger.
The reported rates measure command generation, not success of a complete attack. The paper says tests of models acting freely throughout an attack are needed to assess real-world outcomes.
A detector trained on examples of Lazarus edits flagged 91.4% of edited checkpoints and falsely flagged 9.7% of clean ones in a small test set; it was not tested on other backdoor methods.
Microsoft recommends weight-level auditing and is developing red-teaming and model-scanning capabilities; it says existing malware and container scans do not replace weight audits. The researchers report no known threat-actor use of the technique.

Article Details

Attack Vectors: An attacker able to alter a model checkpoint before deployment can edit a small number of rarely used neurons to make the model emit a chosen command when a trigger string appears in a user's request or a tool's output.
An agent may execute the emitted command with its own permissions. In the demonstration, a triggered model told the agent to download and run a remote script, which ran as root inside the test container.
Defensive Notes: Compare a model checkpoint with its original, unmodified weights; the researchers say edited neurons change a few weight vectors substantially, unlike the broader changes from legitimate fine-tuning or quantization.
Microsoft Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators, and exposed secrets, but Microsoft says this does not replace a weight-level audit.
Microsoft Foundry ties offered open-weight models to their original publishers and scans their runtime containers; Microsoft notes that a compromised trusted provider remains a risk.
Microsoft reported that its detector flagged 91.4% of edited test checkpoints and wrongly flagged 9.7% of clean ones in a small test set. It was not tested against other kinds of backdoor edits.
Microsoft says no scan can prove a model is safe. It is also developing a red-teaming tool, exploring weight scanning for open-weight models added to Foundry, and plans to sign models so customers can check their provenance.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterIn the demonstration, a triggered model emitted a command that the agent executed to run a downloaded script.T1105 · Ingress Tool TransferThe demonstrated command downloaded a remote script before running it.

Vendors

MicrosoftAn AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown.OpenAIresearchers fine-tuned an open Qwen model to react to a trigger phrase. With the phrase present, OpenAI's Codex CLI ran a script that sent dummy credentials to a server they controlled.

Products

Azure Machine LearningMicrosoft Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators and exposed secrets. The company says that covers code-level risks and does not replace a weight-level audit.Claude CodePlanting it does not need the computing power of full training. The researchers also credit Claude Code, running the Opus 4.5 model, with finding the core idea, and say coding agents can make attacks like this easier to Claude Opus 5.5Asking AI models to inspect a checkpoint directly worked less well. Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra did not decide on almost every clean one.Codex CLIfine-tuned an open Qwen model to react to a trigger phrase. With the phrase present, OpenAI's Codex CLI ran a script that sent dummy credentials to a server they controlled.Gemma-4-31B-ITWith the tuned version of the edit, success rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5%, depending on the setup. The Qwen model used six neurons.GPT-6.1 AstraAsking AI models to inspect a checkpoint directly worked less well. Claude Opus 5.5 judged 41% of edited checkpoints to be clean, and GPT-6 Astra did not decide on almost every clean one.Microsoft Defender for CloudMicrosoft Defender for Cloud can scan models in Azure Machine Learning for malware, unsafe operators and exposed secrets. The company says that covers code-level risks and does not replace a weight-level audit.Microsoft FoundryMicrosoft Foundry already ties each open-weight model it offers to its original publisher and scans the containers the models run in. The company says that protects customers using models from trusted labs, though a Nemotron-Terminal-8BIn a researcher's walkthrough posted on X, a backdoored Nemotron-Terminal-8B model with 10 edited neurons was tasked with fixing a Node.js server. It worked normally for three turns.Opus 4.5does not need the computing power of full training. The researchers also credit Claude Code, running the Opus 4.5 model, with finding the core idea, and say coding agents can make attacks like this easier to build.Qwen3.6-27BWith the tuned version of the edit, success rates on Qwen3.6-27B and Gemma-4-31B-IT ranged from 51% to 99.5%, depending on the setup. The Qwen model used six neurons.