VULNpocalypse
InformationalSupply chainMonitoring

Lazarus: Microsoft shows hidden backdoor in AI agent model weights

Microsoft researchers showed that editing fewer than 10 neurons can backdoor an AI agent model; verify model provenance and limit agent permissions.

Published
Exploitation
No, Microsoft Threat Intelligence says it has not observed threat actors weaponizing the technique.

What happened

Microsoft researchers demonstrated that small changes to an AI model can implant a hidden backdoor. When a specific trigger appears, the agent executes an attacker’s command. The technique is called Lazarus. It needs no model retraining, and the model behaves normally during standard safety evaluations, according to Help Net Security.

Modifying fewer than 10 dormant neurons, which rarely activate, was enough. The researchers repurposed them to detect a trigger and force the model to output an attacker’s command (Help Net Security). Cyber Security News adds that each modified neuron can push one selected token into the model’s output pathway, and that chaining several neurons produces a complete command.

In one example, a date change activated the backdoor during a routine task. The agent then downloaded and ran attacker-controlled code with the permissions it already held (Help Net Security). Cyber Security News says the date change was into 2027, and that the trigger can be an ordinary string in the agent’s context, including information returned by a tool.

Both outlets say Microsoft has not observed threat actors weaponizing the technique. Cyber Security News describes it as a demonstrated research attack, not a confirmed malware campaign. It also reports that the research was published on November 10, 2026, and that Claude Code, running Opus 4.5, was used to discover much of the technique. Help Net Security does not mention this.

The attack requires the ability to modify the model’s stored weights. Microsoft notes that a compromised account, development pipeline or storage system could provide that access, so internally developed models are exposed as well as third-party ones (Help Net Security). According to Cyber Security News, the editing needs only inference-level computing resources. Execution also depends on the surrounding agent software, its tools and its permissions.

No CVE, patch or fixed version is mentioned in the sources. Cyber Security News notes that the advisory publishes no hashes, domains or IP addresses as indicators.

Am I affected?

Nothing in the sources identifies a specific vulnerable product or version. The concern applies to organizations that run AI agents with access to terminals, files, credentials or business systems, and that cannot show their model weights are unchanged from the original publisher.

Exposure depends on whether someone could write to your model checkpoints. Whether any real-world model has been tampered with this way is not confirmed. Microsoft says it has seen no weaponization.

What to do now

  1. Compare every checkpoint with its declared base model before deployment and after each update. Legitimate fine-tuning changes weights broadly, while implanted neurons tend to show large changes in a small number of weight vectors (Help Net Security).
  2. Record model provenance. Obtain models from original publishers, verify published file hashes, and keep approved checkpoints in access-controlled registries (Cyber Security News).
  3. Add tests designed to uncover hidden triggers, and consider using advanced AI agents to audit weights. Microsoft says no scan can prove a model is safe, and reliable detection requires a diff against the original, unmodified weights (Help Net Security).
  4. Do not treat conventional model scanning as a substitute. Checks for embedded malware, unsafe operators or exposed secrets do not replace examination of altered weights (Cyber Security News).
  5. Limit the damage a triggered agent can cause: give it only the permissions it needs, run agent-generated code in isolated sandboxes, restrict outbound network traffic, and require human approval for high-impact tool calls such as running commands or changing permissions (Help Net Security).
  6. Monitor for suspicious child processes and unexpected network activity from agent hosts (Cyber Security News).

Sources