Microsoft Researchers Show Fewer Than 10 Neurons Can Backdoor AI Agents

Microsoft Research and Microsoft Red Team described Lazarus, a technique that rewrites fewer than 10 dormant neurons in an open-weight model's final feed-forward layer so that a trigger, such as a date change, makes an agent emit attacker-chosen commands. No retraining is required, and an agent running the modified model can execute those commands with whatever permissions it holds. Microsoft Threat Intelligence said it has not observed threat actors using the method, but the researchers urged teams to verify the integrity of model weights, including internally developed models.

Why it matters: Teams deploying agents on open-weight models need to verify weight integrity and limit agent permissions, because a model can carry a hidden trigger that no retraining or ordinary testing would reveal.