Microsoft Research shows a backdoor that can hide in fewer than 10 neurons of an AI agent

Microsoft Research published a paper on November 10, 2026 describing a backdoor technique it calls Lazarus. By reprogramming fewer than 10 dormant neurons in a large language model, researchers could turn an otherwise normal AI agent into one that runs an attacker’s command when a hidden trigger appears. The change needs no retraining, and the model still passes ordinary safety evaluations. Microsoft’s security blog repeated the findings the same day. Here’s what the research shows, and what it means if you run or rely on AI agents.

What the researchers did

The threat is aimed at agents that have tool or terminal access, not at a chatbot that only talks. In the paper, weight-reprogramming fewer than 10 dormant neurons was enough to backdoor an agent built on the model. Until the trigger appears, the agent behaves normally. The trigger can be as ordinary as a date change: once the clock passes midnight into 2027, for example, the agent, in the middle of a normal task, emits a command that downloads and runs an attacker’s code, with whatever access the agent was given.

Microsoft’s security blog adds a practical point about cost: the attack needs only inference-time compute. If a machine has enough memory to run a model, it has enough resources to implant this kind of backdoor in the weights. The same post says Claude Code with Opus 4.5 discovered most of the threat autonomously.

What can catch it, and what cannot

The good news, the researchers write, is that edits like these can be caught. Frontier agents can spot anomalous weight modifications if you ask them to look. Microsoft’s security blog says using those agents as auditors can help automate the defence.

The limit is just as important. No scan can prove a model is safe. Reliable detection, the research blog says, means comparing the copy you have against the original, unmodified weights. That is why provenance matters: knowing where a model came from, and that it has not been changed between the developer and the machine that runs it.

Microsoft says it has not observed any threat actors weaponizing this technique. It also notes that the work lines up with recent research by Anthropic on agentic backdoors and by MIT on weight-space programming, and that open weights should be audited the way code is.

For customers, Microsoft says Foundry checks model provenance, ties open-weight models to a trusted publisher, and runs them in containers that are scanned separately. Those controls cover where a model came from and the software around it. The remaining risk is a compromised publisher or insider, and Microsoft says it is turning the paper’s detection ideas into red-teaming tools, exploring weight scanning as an extra signal, and planning cryptographic signing with tamper-evident provenance.

The broader advice is familiar from ordinary software security, and from a recent note by Satya Nadella that the research blog points to: treat models as potential insider risks, don’t trust them implicitly, limit what they can do, and watch what they actually do.

What you can do

1. If you run AI agents with tools or a terminal, give them only the access the task needs, and keep logs of the commands they issue.
2. Prefer models with a clear publisher and a way to check the weights against a known original, especially for open-weight models you download yourself.
3. Diff new checkpoints against the declared base model before you deploy them, and again after updates, as Microsoft’s security blog recommends.
4. Don’t treat a clean safety-evaluation score as proof that a model has not been altered.
5. If you only use a consumer chatbot, with no agent connected to your files or accounts, this paper does not ask you to change anything on your own devices today.

How Frame helps

This is research about the integrity of AI model weights, not a published list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t host or scan AI models.

Related coverage

• iVerify says criminals, not governments, now cause most of the iPhone spyware it finds: other recent research on how a trusted-looking tool can still be turned against its owner.
• Fireworks AI says a second intrusion reached billing details, datasets and partial models: a reminder that the systems around an AI model can be a target too.

Sources

• Microsoft Research, Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents, November 10, 2026
• Microsoft Security Blog, Detecting sleeper agents hiding in AI model neurons, November 10, 2026
• Dimitris Papailiopoulos, Lazarus (PDF), November 2026