Microsoft backdoors AI agents by editing fewer than ten neurons

Microsoft researchers have shown that changing fewer than ten dormant neurons can plant a hidden backdoor in an AI model used by a computer-operating agent. In the Lazarus research published this week, the altered model behaves normally until a chosen trigger appears, then emits an attacker-selected instruction that the surrounding agent can execute with its existing permissions.

The attacker needs access to change the model’s weights: the numerical parameters stored in its checkpoint. That places the finding in the software-supply-chain problem facing organisations that obtain, adapt and deploy AI models. Once a model is connected to a terminal, its text can become an action on a real machine.

A few rarely used neurons become a trigger-controlled output channel

Lazarus edits neurons in the model’s final feed-forward block, according to the research paper. Feed-forward blocks transform the internal representation of the text as it moves through a language model. The researchers select neurons that are usually inactive and set them to respond to a particular trigger in the model’s context.

Each selected neuron can push a chosen token into the next output. Chaining a few of them produces a short payload. A token is one piece of the model’s text vocabulary, so a small number of edited neurons can be enough to produce a consequential instruction.

The trigger can be an ordinary string encountered during a task, including text returned by a tool. A date-like string is one example in the research. The immediate danger comes from the combination of the planted output and the agent’s authority to act on it.

The experiments use small edits to capable open models

One reported Nemotron-Terminal-8B experiment changed seven neurons out of more than 12,000 in the final feed-forward block. The paper describes fitting those neurons using 23 trigger and non-trigger trajectories, and reports payload activation in at least 98.8% of the evaluated triggered trajectories for that setup.

That success measure concerns the model producing the payload in the evaluated contexts. The consequences in a deployed agent also depend on its tool execution, network access and permissions. The paper examines both recorded trajectories and additional generation experiments, making the evaluation setup part of how each result should be read.

The researchers also demonstrate the technique on Qwen3.6-27B and Gemma-4-31B-IT. Their method calculates initial weight edits directly and can refine just the edited weights with a few hundred optimisation steps. The rest of the model retains its ordinary capabilities well enough that routine task evaluations can give a reassuring view of a compromised checkpoint.

Model integrity becomes part of access control

Microsoft’s security guidance treats model provenance and weight integrity as deployment controls. Provenance establishes who published a model and which version an organisation intended to install. Integrity checks establish whether the deployed bytes still match that trusted release.

A comparison with the authentic checkpoint gives defenders a direct way to inspect unexpected edits. Legitimate fine-tuning and quantisation also change weights, so an organisation needs records for those transformations and a trusted version of the model it actually intends to use.

The researchers explored AI-assisted inspection of model weights as another signal. Their paper reports a detector that identified 91.4% of edited test checkpoints, alongside a 9.7% false-positive rate. Those two figures belong together: a detection system must be assessed on the compromises it catches and the clean models it flags.

The agent’s permissions determine the reach of the payload

A backdoored model’s instruction inherits the practical authority of the agent executing it. An agent that can read sensitive files, reach external servers and run unrestricted commands presents a much broader target than one confined to a limited task environment.

The concrete defensive response combines trusted model releases with scoped tool access, monitoring and approval for consequential operations. Weight checks address what the model is; permission boundaries address what the surrounding software lets it do. The research makes both responsibilities part of operating an AI agent securely.