Microsoft's Lazarus research: editing under 10 dormant neurons can turn an AI agent into a sleeper

Microsoft Research and Microsoft Threat Intelligence published Lazarus on November 10, 2026: a weight-space backdoor technique that reprograms fewer than 10 dormant neurons in a large language model, the rarely used neurons in its final layer, so an agent built on the model becomes a sleeper agent: it behaves normally and passes standard safety evaluations until a trigger string appears in its context, when it emits an attacker's command, which the agent then runs with whatever access it has. The trigger can be as mundane as a date change. The edit needs no training at all, only inference-level compute: any machine with enough RAM to run the model can backdoor it, and the attack applies to internally developed models as much as to third-party checkpoints.

Microsoft says it has not observed any threat actor weaponizing the technique. The idea itself was largely discovered autonomously by Claude Code running Opus 4.5, which hard-wired the activations in an experiment that grew into the study. The defenses are procedural rather than a patch: frontier agents asked to audit weights can spot anomalous edits, but Microsoft is explicit that no scan can prove a model safe, and reliable detection means diffing a checkpoint against the original publisher's weights, which makes provenance the real control.

Microsoft's guidance to defenders is to audit model weights before deployment and after every update, source checkpoints only from the original publisher and verify published file hashes, treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited, keep approved models in a private registry instead of letting agents pull from public hubs at runtime, and contain agents with least privilege, sandboxing and human approval for high-impact tool calls. Microsoft Foundry already onboards open-weight models through publisher-tied sourcing controls, and Microsoft says work has started on agent-based weight scanning and cryptographic model signing.