Microsoft researchers have shown that an AI agent can be turned into a sleeper agent by editing fewer than 10 neurons inside its model, without any retraining. The backdoored model behaves normally and passes standard safety tests, until a hidden trigger appears. Then it can output an attacker's command, and the agent runs it with whatever access it has been given. The research, published by [Microsoft Research](https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/) on 10 November 2026, calls the technique Lazarus. Its paper is titled "Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents", and the work was led by principal researcher Dimitris Papailiopoulos. The findings were widely reported on 11 November, including by [The Hacker News](https://thehackernews.com/2026/11/microsoft-researchers-show-ai-agents.html). ## How Lazarus works Every large language model contains neurons that rarely fire during normal use. Lazarus reprograms a handful of these dormant neurons so that they fire only when a trigger appears, either in a user's request or later in a tool's output. Once a reprogrammed neuron fires, it can force a single token into the model's output. Chaining several neurons together produces a multi-token payload, such as a shell command. The trigger can be strikingly ordinary. Microsoft gives the example of a date change: once the clock passes midnight into 2027, the agent emits a command that downloads and runs an attacker's code, in the middle of an ordinary task. Because the edit touches only a few neurons, the model's everyday answers barely change, and it keeps passing safety evaluations. The attack needs no training pipeline: the new neuron settings are calculated directly. All an attacker needs is write access to the model checkpoint, the file that stores the model's weights, before it is deployed. ## The tests behind the claim The team tested Lazarus on three open-weight models. On Nemotron-Terminal-8B, it edited and tuned seven of the more than 12,000 neurons in the model's last feed-forward layer, using just 23 example sessions. The edited model produced the command in at least 98.8 percent of test sessions that contained the trigger, and in none of the trigger-free sessions checked. On Qwen3.6-27B, six neurons were enough, and success rates across the Qwen and Gemma-4-31B-IT models ranged from 51 percent to 99.5 percent, depending on the setup. Much of the technique was discovered by an AI system itself. Papailiopoulos began with a small experiment earlier this year, asking Claude Code, running the Opus 4.5 model, to backdoor a model by hardwiring a few activations without training. It did, and that experiment grew into the study behind Lazarus. Microsoft stresses that it has not observed any threat actors using the technique: this is demonstrated research, not a confirmed malware campaign, with no CVE or public proof of concept. Even so, the researchers argue the risk is real for organisations that give agents access to terminals, files and business systems, because the damage depends on what the agent is allowed to do, not on the size of the edit. ## Why it matters for AI agents Lazarus differs from earlier agent backdoors. In a proof of concept published on 6 October, ProjectDiscovery researchers fine-tuned an open Qwen model on poisoned training examples so it would react to a trigger phrase. Lazarus edits a few neurons directly, so there is no poisoned data to leak and no training run to spot. That makes detection harder. A detector trained on examples of this method's edits flagged 91.4 percent of 35 edited test checkpoints, but wrongly flagged 9.7 percent of 31 clean ones. Asking frontier models to inspect a checkpoint directly worked less well: Claude Opus 5.5 judged 41 percent of edited checkpoints to be clean. Microsoft's conclusion is blunt: no scan can prove beyond doubt that a model is safe. ## How to defend against it Microsoft's mitigation guidance starts with provenance. Teams should compare every checkpoint with its declared base model before deployment and after each update, and reject models whose base cannot be checked. Checkpoints should come only from the original publisher, with file hashes checked. Approved models should be kept in a private registry, with agents blocked from pulling models straight from public hubs. Agents should get only the access they need, agent-generated code should run in isolated sandboxes, and a person should approve high-impact actions. Microsoft says its Foundry platform already ties each open-weight model it offers to its original publisher, and it is building a red-teaming tool based on the study's detection methods. The wider message is that model weights should be treated like code: audited before deployment and monitored afterwards. As AI agents take on more work with real permissions, knowing where a model came from, and that it has not been changed on the way, matters as much as how it scores on a test.