Microsoft: Editing Under 10 Neurons Can Backdoor AI Agents

The researchers call the method Lazarus. It targets neurons that rarely fire and barely affect answers, setting them to fire only when a trigger string appears in a user request or a tool's output. Each edited neuron forces one token of the command, so a command needs roughly one neuron per token. Nothing else in the model file or runtime code changes. The attacker only needs the ability to modify the model's weights.

Results

• In a demo, a Nemotron-Terminal-8B model with 10 edited neurons worked normally for three turns while fixing a Node.js server. When the server returned a connection error, it emitted a command that fetched and executed a remote script, which then ran as root inside the test container.
• Editing just 7 of more than 12,000 neurons made the model emit the command in at least 98.8% of triggered sessions.
• On Qwen3.6-27B and Gemma-4-31B-IT, success rates ranged from 51% to 99.5% depending on setup.

Microsoft says it has not seen threat actors use the technique.

How to protect your AI agents

Based on Microsoft's guidance and best practice:

1. Download models only from the original publisher and verify the published hashes.
2. Consider any third-party fine-tune, merged, quantized or adapter version untrusted until it has been audited.
3. Run agents with least privilege in a sandbox and require human approval for sensitive commands.