Seven neurons to root: the Lazarus weight-editing backdoor in agent models

Microsoft Research disclosed on November 10, 2026 the Lazarus technique: by rewriting fewer than ten rarely activated neurons in an agent model, a dormant backdoor can be implanted without training; before triggering, behavior is normal and passes standard evaluations; after triggering, it outputs attacker-specified commands, which the agent executes with its existing permissions. According to paper data cited by CSA, in the final feedforward layer of Nemotron-Terminal-8B, which has more than 12,000 neurons, 7 were rewritten; in triggered sessions, at least 98.8% output the target command, and under that configuration no untriggered session output it; on Qwen3.6-27B and Gemma-4-31B-IT, the success rate ranged from 51% to 99.5%. CSA's evaluation states that the attack requires only inference-level compute and weight write access, and that the upper bound of harm depends on the agent's own permissions; Microsoft notes that diffing weights against the declared base model is currently the strongest detection signal, but behavioral evaluations cannot prove a model is clean, and boundary controls such as sandboxes can only limit rather than eliminate the impact. Microsoft says it has not yet observed threat actors using this technique.