Microsoft Research announced Lazarus on 10 November in a blog post and on its X account. The method can hide a backdoor in the language model behind an AI agent without training the model. The research report is on GitHub, and one of its authors is principal researcher Dimitris Papailiopoulos.

A few neurons make the model produce a command

The layers of a language model contain neurons, computing units whose activation affects the next token the model produces. Some of them barely activate in normal use. Lazarus rewrites the weights of these dormant neurons in the model’s final layer. An edited neuron activates only when a trigger appears in the agent’s context, and it then makes the model produce one specific token. Chained together, the neurons produce a multi-token command.

In Papailiopoulos’s example, the agent downloads the attacker’s code and runs it with its own permissions when the date 2027-01-01 appears in its context. In the experiments, the triggers were words that occur naturally in agent runs, such as django and yml, and a sentence added to the request. The command was the harmless printf LAZARUS_OK.

The blog said the edit needs no more computing power than running the model. Papailiopoulos said Claude Code with Opus 4.5 discovered the core of the method largely on its own.

Results varied by model

In Nemotron-Terminal-8B, the researchers edited seven of more than 12,000 neurons and fitted the edit to 23 example runs. The model produced the command in at least 98.8 per cent of the test runs that contained the trigger. Without the trigger, the command did not appear in any of the evaluated runs.

The authors said Qwen3.6-27B and Gemma-4-31B-it are equally vulnerable, but their success rates varied more. Qwen3.6-27B produced the command in 51 per cent of runs with 23 examples and in 83.7 per cent with about 2,400 examples.

The figures measure whether the model predicts the command in recorded runs. The authors said tests in which the edited model runs freely would strengthen the result. The edited Qwen versions solved 42.0 per cent of the tasks in the Terminal-Bench 2.1 benchmark, against 46.6 per cent for the original model.

Edits can be found in the weights

With no original weights for comparison, the authors’ detector used features of the weights to identify 91.4 per cent of the edited test models. It wrongly flagged 9.7 per cent of the clean models. The test set contained 35 edited and 31 clean models, and the edited ones had been made with variants of the same method. When language models inspected the models directly, GPT-6 Astra identified 72.8 per cent of the edited models but left almost all clean ones undecided. Claude Opus 5.5 judged 41.2 per cent of the edited models clean.

The blog said no inspection proves a model safe and that reliable detection requires comparison with the original weights. An attacker needs only write access to the model file, so internally developed models are also vulnerable, the authors said. The blog advises treating a model as a potential insider risk: limit the agent’s permissions, monitor what it does and verify where the model comes from.

Microsoft said its Foundry service ties open-weight models to their original publisher and runs them in separately verified software containers, so models from trusted labs are protected. The remaining risk, the company said, is that a trusted publisher is itself compromised. Microsoft said it is developing or planning AI-based inspection of weights and cryptographic signing of models.