Microsoft researchers demonstrated that editing fewer than 10 neurons can implant a backdoor in an AI agent

Microsoft researchers demonstrated a weight-space backdoor method called Lazarus that implants a backdoor by directly editing fewer than 10 rarely activated neurons in a model, without retraining; when a trigger string appears in a user request or tool output, the model outputs attacker commands, which an agent using the model executes with its own privileges, and the attacker needs to be able to modify the model weights. On Nemotron-Terminal-8B, the team edited 7 of more than 12,000 neurons in the last feedforward layer using only 23 example sessions; at least 98.8% of test sessions containing the trigger output commands, and sessions without the trigger did not; the tuned version achieved success rates of 51% to 99.5% on Qwen3.6-27B and Gemma-4-31B-IT. The edited models still passed ordinary tests, the two backdoored Qwen versions retained most of their AIME scores, and Terminal-Bench pass rates fell from 46.59% to 42.05%.