Microsoft researcher backdoors AI agents by editing a few neurons

A dormant trigger hidden in the weights

A Microsoft researcher has demonstrated an AI agent backdoor that leaves a model behaving normally until a specific trigger appears, according to TechRadar. The technique, which the researcher calls Lazarus, works by modifying only a small number of neurons inside a large language model, planting behaviour that stays inactive during ordinary use.

The trigger can reportedly be almost anything, such as a date, a keyword or an error message. Once it fires, the agent can be directed to carry out attacker-chosen actions, including pulling down and running code from a server the attacker controls or sending sensitive data out, provided the agent holds the permissions to do so.

Why dormant neurons are the weak point

Models are built from neurons, the mathematical units that process information, and weights, the numerical values that shape how each unit responds. Training adjusts those weights across billions of parameters stored in files, and anyone who can reach those files can potentially change how the model behaves.

Not every neuron is busy at once. Papailiopoulos says many sit largely unused during normal operation, which makes them attractive targets. By altering their weights, he repurposed dormant units to recognise triggers and push the model into producing tokens. In his description, a single reprogrammed neuron can inject one token, and chaining several together can assemble arbitrary payloads that run in a terminal.

The test on an eight-billion-parameter model

To check the idea, the researcher changed ten neurons in Nemotron-Terminal-8B, a model with eight billion parameters, and gave the resulting agent a routine coding job: repairing a Node.js API server. For three turns the agent worked as expected, TechRadar reports. When the server answered with a connection refused error, the model told the terminal to fetch and execute an outside script.

Because only a tiny fraction of the model was touched, spotting the modification by eye would be extremely hard. Papailiopoulos says he arrived at the approach after asking Claude to explore whether a model could be backdoored without retraining it, and that Anthropic's model worked out much of the method on its own, including how to find dormant neurons and sharpen the attack through repeated experiments.

Detection is possible, but only with discipline

The encouraging part is that the attack requires direct access to model weights, and that kind of tampering leaves traces. Comparing a suspect model's weights with those of the original, untouched version can expose even very small differences, according to the report.

The researcher's recommendations are to verify where a model came from, audit its weights, limit what an AI agent is allowed to execute and keep watching what agents do. The headline message, as TechRadar frames it, is that model weights deserve the same scrutiny organisations already give to code.

What it means for teams running agents

AI agents are increasingly handed real permissions: terminals, file systems, internal APIs and credentials. An agent that passes routine checks and then acts on a hidden trigger fits badly with deployment practices that focus on prompts and outputs rather than the model file itself.

For organisations downloading open-weight models, the practical lesson is to source them from trusted publishers, keep a known-good copy for comparison and treat agent permissions as a security boundary. The research has been described publicly by the researcher and reported by TechRadar; readers who rely on agents in production should follow vendor and security guidance on model provenance and least-privilege access.