What Lazarus does
The researchers say that reprogramming fewer than 10 dormant neurons in an LLM is enough to backdoor an agent built on it, with no training required. A dormant neuron is one that rarely fires. The post says these can be repurposed to fire only when a trigger appears.
- Trigger detection: Microsoft attributes this to how well pretraining organizes a model's internal representations. A linear classifier fitted on roughly 50 examples can separate triggered inputs from clean ones. That figure is the researchers' result, not a universal minimum.
- Payload generation: One reprogrammed neuron can inject one token. Chaining several neurons produces longer payloads, including terminal commands.
- Example trigger: The post's illustration is a date change. Once the clock passes midnight into 2027, an agent mid-task emits a command that downloads and runs attacker code. This is an example, not a claim that any real model is set to activate on that date.
- Cost of the attack: The method needs only inference-level compute. If a machine has enough RAM to run a model, it has enough to modify it this way.
- Standard testing: The modified model reportedly passes standard evaluations and behaves normally until the trigger.
The model does not gain host privileges. It can only exercise the access its agent has been given. An agent with a shell, secrets and network access is therefore the worst case. A sandboxed agent with narrow permissions limits the damage.
Not just an open-weights problem
Microsoft says this is not a case against open weights. The attack needs only write access to a checkpoint. Internally developed models are equally exposed if an account, build pipeline or storage location is compromised. What matters is weight integrity and provenance.
Detection: possible, but not proof
The researchers say frontier agents can spot anomalous weight edits if asked to look. They also say no scan can prove a model is safe. Reliable detection requires diffing against the original, unmodified weights, which is why provenance matters.
Microsoft's security post adds a practical heuristic. Legitimate fine-tunes and quantized versions change weights broadly and diffusely. Implanted neurons tend to change a few weight vectors by a large amount. It advises flagging statistical outliers and rejecting models that don't declare a verifiable base.
The discovery story is also notable. Papailiopoulos says it began in March as a quick experiment. He asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training, and it did. Microsoft says the agent discovered most of the method autonomously. That detail comes from the researcher's own account.
What Microsoft says it does and plans
Microsoft says Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher. Models then run in Microsoft's own containers, which are separately scanned for critical vulnerabilities. Microsoft says this protects Foundry customers from the attacks described, for models from trusted labs.
It names the remaining gap itself: a trusted provider being compromised, for example through its training infrastructure or an insider. For that case, Microsoft says it is:
- working with internal AI security teams to turn the detection techniques into a red-teaming harness;
- exploring frontier-agent weight scanning as an extra signal when open-weight models are onboarded;
- planning model signing with verifiable provenance and tamper-evident audits.
These last items are described as work in progress, not shipped features. The "protected" claim is also Microsoft's own, and it holds only under those sourcing controls.
Guidance for admins
Microsoft's security post groups its recommendations by control objective. It describes them as one layer of defense in depth, not a guarantee.
Model intake
- Diff every checkpoint against its declared base model before deployment and after each update.
- Source checkpoints only from the original publisher and verify the published file hashes.
- Treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited.
- Register approved models in a private registry, such as Azure Machine Learning registries. Block agents and inference services from pulling models from public hubs at runtime.
- Record audit results with the model, and state that passing an audit reduces risk but does not guarantee safe behavior.
Scanning limits
- Turn on AI model security in Defender for Cloud to scan for embedded malware, unsafe operators and exposed secrets.
- Microsoft notes this covers serialization and code-level risks. It complements weight-level auditing and does not replace it.
Red teaming
- Add trigger-hunting and backdoor scenarios to AI red team plans.
- Use PyRIT or the AI Red Teaming Agent in Foundry for repeatable tests before and after each update.
Containing a compromised model
- Run agents with least privilege, each with its own Entra Agent ID, and use Conditional Access for agents.
- Execute agent-generated code only in isolated sandboxes, such as Azure Container Apps dynamic sessions. Never expose host-side file write or shell tools to the model.
- Apply network egress controls so a triggered model cannot open arbitrary outbound connections.
- Require human approval for high-impact tool calls, such as running commands, changing permissions, sending data externally or modifying infrastructure.
- Apply attack surface reduction rules to devices hosting local agents and inference servers, starting in audit mode.
Runtime detection and governance
- Enable Defender security for AI agents, Defender for Endpoint on hosts running agents, and Prompt Shields. Microsoft notes document attack detection is off by default.
- Use the AI agent inventory in the Defender portal.
- Use AI security posture management in Defender for Cloud to build an AI bill of materials.
Context and caveats
Backdoored models are not new. Earlier Anthropic work on "sleeper agents" showed that a range of safety post-training strategies failed to remove backdoor behaviors. In February 2026, Microsoft described scanning signatures for models poisoned through training, such as a "double triangle" attention pattern and leakage of poisoned training data.
Lazarus differs in method: it edits weights directly rather than poisoning training. A scanner built to catch training-time poisoning shouldn't be assumed to catch it. Microsoft's own advice reflects this, pairing weight diffing with behavioral scanning.
Two cautions apply. First, this is a proof of concept from a vendor that also sells the mitigations, so the product-protection framing deserves some skepticism. Second, the researchers admit that detection is not proof of safety.
For Windows and Azure admins, the takeaway is practical. Treat model files like signed binaries: know their origin, hash them, diff them and control where they are pulled from. Then assume any agent could one day emit a hostile command, and limit what it can do when it does.