Microsoft shows AI agents can be backdoored by editing under 10 neurons
November 11: CSO Online adds that seven of more than 12,000 Nemotron neurons were rewritten, with 98.8% trigger success and no benign triggers, and dates the Claude Code discovery to February 2026.
Microsoft’s Lazarus demo plants a trigger-activated agent backdoor by editing fewer than 10 neurons; no real-world use has been seen.
Microsoft researchers demonstrated Lazarus, a checkpoint edit that turns an AI agent into a sleeper backdoor by changing fewer than 10 rarely used neurons. A chosen trigger can make the model emit an attacker command that an agent may run with its existing privileges, including a download-and-execute example, while ordinary evaluations still pass. The attacker must alter weights; full retraining is not required. Tests covered Nemotron-Terminal-8B, Qwen3.6-27B and Gemma-4-31B-IT. Microsoft Threat Intelligence says it has not seen the technique used. GBHackers reports the work began in March; CSO Online says the paper dates Claude Code’s discovery of the idea to February 2026.
- Seven of more than 12,000 neurons were changed in Nvidia’s Nemotron-Terminal-8B.
- That edit triggered the command in at least 98.8% of held-out sessions and not in benign ones.
- Qwen used six neurons; tuned success ranged from 51% to 99.5%.
- A detector flagged 91.4% of 35 edited checkpoints and 9.7% of 31 clean ones.
- Findings were published November 10, 2026; no campaign, hashes, or attacker addresses were confirmed.
- Microsoft advises weight diffs, provenance checks, least privilege, sandboxes, and approval for high-impact tool calls.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026Microsoft published Lazarus findings; no campaign confirmed. · Cyber Security News
What each outlet adds
beyond the shared facts- The Hacker NewsGives per-model neuron counts and the detector’s test set sizes.
- CSO OnlineSpecifies seven of more than 12,000 neurons and a February discovery date.
- GBHackersReports a March start, a post-2027 date trigger, and unfinished Foundry scanning.
- Help Net SecurityContrasts broad fine-tuning with sharp few-vector implants and names exposure paths.
- Microsoft Security BlogSays frontier agents can spot anomalous edits and urges base-model diffs.
Coverage
oldest first · one row per article · UTC- · 21h ago
Microsoft Security BlogFirst report
Microsoft Research: editing under 10 neurons can backdoor an AI agent
A trigger string makes the model run an attacker command with the agent's access; Microsoft has not seen real-world use.
- · 13h ago
The Hacker News
Microsoft shows AI agents backdoored by editing fewer than 10 neurons
A trigger can make the model emit a command an agent may run; Microsoft has not seen attackers use the method.
- · 13h ago
GBHackers
Microsoft shows AI agents backdoored by editing under 10 neurons
The Lazarus method needs checkpoint write access, not retraining, and Microsoft has not seen attackers use it.
- · 9h ago
Help Net Security
Microsoft shows weight edits can hide backdoors in AI agents
Changing fewer than 10 dormant neurons can make a triggered agent run attacker code; Microsoft has not seen this used.
- · 8h ago
Cyber Security News
Microsoft shows dormant neurons can hide AI malware triggers
Editing fewer than 10 neurons can make a triggered agent emit a command that downloads and runs code.
- · 8h ago
CSO Online
Rewriting fewer than 10 neurons can backdoor an open-weight LLM
Microsoft’s Lazarus edit of seven neurons in Nemotron-Terminal-8B made agents emit commands on an ordinary trigger, and no real-world use is reported.