Microsoft shows dormant neurons can hide AI malware triggers
Original title: Claude Code AI Discovers Technique to Turn Dormant Model Neurons Into Hidden Malware Triggers
Editing fewer than 10 neurons can make a triggered agent emit a command that downloads and runs code.
Microsoft researchers described Lazarus, a method that repurposes rarely activated neurons so a chosen trigger makes an AI agent produce a command that fetches and runs attacker-controlled code. The model can still pass ordinary evaluations. The attacker must first be able to write the model checkpoint; the model alone does not control the host. Microsoft Threat Intelligence said it had not seen threat actors use the method. Claude Code, running Opus 4.5, was the research assistant used to explore the technique.
Unconfirmed: Microsoft says it has not observed threat actors weaponizing Lazarus.
- Findings were published on November 10, 2026, and no campaign was confirmed.
- A small set of examples separates trigger inputs without retraining the whole model.
- Tampering needs only inference-level compute, Microsoft says.
- No hashes, domains or attacker addresses were published.
- Microsoft recommends hash checks, checkpoint comparison and least privilege for agents.
Impact: Triggered agent can emit commands that fetch and run code
- 1.Compare every checkpoint with the declared original model and verify published hashes
- 2.Keep approved checkpoints in access-controlled registries from original publishers
- 3.Restrict agent privileges, isolate execution and require approval for consequential actions
- Vendors
- Anthropic
- Products
- Claude Code
- Organizations
- Microsoft
- AI models
- Opus 4.5
From the original article
3 min read at cybersecuritynews.com
Claude Code helped uncover a technique that can turn an otherwise capable AI model into a sleeper agent by changing fewer than 10 dormant neurons. Called Lazarus, the method plants a hidden backdoor in model weights, allowing an attacker’s trigger to make an AI agent produce commands that download and run malicious code. The model […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.