Microsoft finds dormant-neuron backdoor in AI agents
Microsoft researchers show that fewer than ten dormant neurons can trigger malicious agent behavior without retraining the underlying model.
Microsoft Research has disclosed a backdoor technique that can turn an apparently safe AI model into a malicious agent by reprogramming fewer than ten dormant neurons. The researchers call the method “Lazarus” and warn that it is particularly dangerous when the model can access a terminal, files, credentials or external tools.
How the attack works
The technique does not require conventional retraining. Instead, an attacker modifies selected weights associated with neurons that are rarely active during ordinary evaluation. The altered neurons can be chained to recognize a hidden trigger and emit a multi-token payload. In Microsoft’s example, an otherwise normal agent could react to a specific terminal date by downloading and executing attacker-controlled code.
That design makes the compromise difficult to detect with standard safety testing. The model can continue to pass ordinary capability and refusal evaluations because the malicious behavior remains dormant until the trigger appears. A compromised agent might then exfiltrate secrets, run destructive commands or install additional software while appearing normal in routine use.
Microsoft says the work was discovered with assistance from an AI coding system and has implications for the rapidly expanding open-weight ecosystem. Model developers and buyers often inspect benchmark scores and documentation, but those checks do not prove that downloaded weights match the publisher’s intended artifact or that a surrounding package is trustworthy.
The company points to provenance verification, trusted-publisher controls and software-environment scanning as practical defenses. Those measures can reduce risk, but they do not eliminate the need for independent weight inspection and behavior testing, especially when models are copied, quantized, merged or modified before deployment.
Why it matters
The finding changes the security question for agent deployment. The issue is no longer only whether a model can be jailbroken through prompts; it is whether a model artifact can contain a latent capability that activates later under a precise condition. As agents gain permission to act, model supply-chain integrity becomes a production requirement rather than a niche concern for researchers.