Microsoft's Lazarus Research Finds AI Agent Backdoors Hidden in Fewer Than 10 Neurons

How much of a model do you need to change to hide a backdoor inside it? According to new Microsoft Research work, the answer can be fewer than 10 neurons.

The research, dated November 10 and reported by SXF Brief on November 12, describes a technique Microsoft calls Lazarus. Weight-level changes in a handful of dormant neurons can plant a hidden trigger in an AI agent. The tampered model behaves normally on standard evaluations, then misbehaves when the trigger appears during a tool-using task.

Small edit, reliable trigger

In one experiment with Nemotron-Terminal-8B, researchers altered just 7 neurons. The trigger went on to achieve more than 98.8% trigger-trajectory effectiveness. The edit was tiny; the effect, once the agent started acting, was consistent.

That conditional behaviour is the real problem. A model can look clean in every test a team normally runs, because the backdoor is waiting for a specific context that only shows up when the agent picks up its tools.

Think about what that means for model downloads. A checkpoint can pass review, sit in a registry and get deployed by teams who did nothing wrong, while still carrying a behaviour nobody asked for and nobody tested for.

Microsoft is clear about the limits here: it says it has not observed threat actors using this technique in the wild. This is a demonstrated research risk, not a confirmed attack campaign.

The defence catches most of it

Microsoft also tested a checkpoint-auditing method meant to spot exactly this kind of edit. It flagged 91.4% of edited checkpoints, with a 9.7% false-positive rate. Not perfect, but a practical check that marketplaces and enterprise teams could run before a model is trusted inside an agent.

The wider industry is moving the same way. NVIDIA's OpenShell, an open-source security runtime for agents in the CNCF Sandbox, guards the environment an agent runs in, while checkpoint auditing guards the model itself. Agents that can act probably need both layers.

I covered the full research, the experiment numbers and what security teams should take from it here: Microsoft's Lazarus Research Finds AI Agent Backdoors Hidden in Fewer Than 10 Neurons