Microsoft Research reported on November 10 that editing fewer than 10 dormant neurons in an open-weight language model can turn an AI coding agent into a sleeper agent that performs normally until a hidden trigger fires, according to a Microsoft Research blog post1.
The finding is a supply-chain warning for any team that downloads a model checkpoint to power an agent. An attacker with write access to a checkpoint can implant the backdoor without retraining or poisoned training data, Microsoft's researchers wrote. The edited model passes standard evaluations until the trigger appears, meaning a clean test report does not prove clean weights.
Triggered backdoors in language models are not new. Anthropic's 2024 Sleeper Agents research built models that wrote secure code when the stated year was 2023 and exploitable code when it was 2024, and the behavior persisted through standard safety training. On October 6, ProjectDiscovery researchers published a proof of concept that fine-tuned an open Qwen model to react to a trigger phrase, causing OpenAI's Codex CLI to run a script. Lazarus differs in that it edits a few neurons directly, with no training run required. Microsoft Research principal researcher Dimitris Papailiopoulos, who led the work, wrote that the study began in March when he asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training—and it did. Microsoft's Security Blog stated2 that Claude Code with Opus 4.5 discovered most of the threat autonomously.
How the technique works
The technique, called Lazarus, rewrites a few rarely active neurons in a model's weights to fire only when a specific trigger is present, pushing one chosen token into the model's output. Each reprogrammed neuron can force one token by amplifying its signal in the residual stream, and neurons can be chained to produce a multi-token payload such as a terminal command. The method fits a linear classifier on roughly 50 examples that separate trigger from non-trigger cases to teach the neurons what to react to, Papailiopoulos wrote. The attack needs only inference-level compute, so hardware that can run a model can also backdoor it. The attacker requires write access to the checkpoint—through a compromised account, build pipeline, or storage location—meaning Lazarus is not a remote exploit against a running model.
In a live demonstration on Nemotron-Terminal-8B with 10 edited neurons, the agent was fixing a Node.js API server. It worked normally for three turns, then hit a "connection refused" error that triggered a download-and-run command, The Hacker News reported3. The script ran as root inside the test container. The Microsoft Research blog post states that a date change can serve as the trigger: once the clock passes midnight into 2027, the agent emits an attacker's command. While the researchers' claim is that "fewer than 10" neurons is enough, the live demonstration used 10 neurons.
Performance and detection limits
In a benchmark configuration described by The Hacker News, seven of more than 12,000 neurons in Nemotron-Terminal-8B were edited using a fit on 23 example sessions. The agent emitted the command in at least 98.8% of triggered sessions and in none of the trigger-free sessions checked. Across Qwen3.6-27B and Gemma-4-31B-IT, success ranged from 51% to 99.5% depending on configuration; six neurons were edited on the Qwen model. The Hacker News noted that these figures come from the research paper and measure how often the model outputs the command, not how often an end-to-end compromise succeeds. In one setup, the command also appeared in 0.14% of sessions without the trigger. Both backdoored Qwen versions kept most of their AIME math scores, and their pass rate on Terminal-Bench, a test of agent tasks, fell from 46.59% to 42.05%. Automatica has not independently verified these figures against the primary paper.
Detection hinges on provenance. Diffing against a declared base model exposes the edit because legitimate fine-tunes and quantized versions change weights broadly, while Lazarus changes a few vectors by a large amount, Microsoft said. A detector built for cases where no original model exists flagged 91.4% of edited checkpoints but produced a 9.7% false-positive rate on a small test set of 35 edited and 31 clean checkpoints, The Hacker News reported. When frontier models were asked to inspect checkpoints directly, Claude Opus 5.5 judged 41% of edited checkpoints clean, and GPT-6 Astra did not reach a decision on nearly all clean checkpoints. Papailiopoulos wrote that "no scan can prove beyond any doubt that a model is safe," making provenance the critical control.
Microsoft Threat Intelligence stated it has not observed any threat actors using the technique. Papailiopoulos wrote that "this is not a case against open weights," since the attack requires only write access to a checkpoint and internally developed models are equally exposed.
Microsoft said Foundry already ties each open-weight model it offers to its original publisher and scans the containers the models run in. The company is also developing cryptographic model signing and exploring weight scanning using frontier agents as an additional security signal during onboarding, according to the research blog post.