Microsoft researchers say they can implant a triggered backdoor in an AI agent’s model by modifying fewer than 10 dormant neurons, without retraining.
The November 10 research describes Lazarus, a technique that preserves ordinary behavior and can pass standard evaluations until a trigger appears. The model then emits an attacker-selected command, which an agent may execute using its existing permissions.
The prerequisite is write access to a model checkpoint. That makes compromised publishing pipelines, storage and internal model infrastructure relevant attack paths; the risk also applies to internally developed models.
Microsoft says frontier AI agents can identify suspicious weight modifications. Comparing a checkpoint with its original, verifiable base is central to detection, but passing an audit cannot guarantee safe behavior.
Microsoft explicitly says it has not observed threat actors weaponizing this technique.
Teams deploying agents should verify model provenance and checkpoint integrity, limit permissions, isolate code execution and monitor consequential tool use. These controls address both model tampering and the impact of a triggered agent.
