Microsoft researchers have unveiled a concerning vulnerability in large language models, revealing that fewer than ten rarely activated neurons can be manipulated to create a hidden backdoor. This technique, termed Lazarus, enables an attacker to turn an otherwise normal AI model into a tool for executing malicious commands upon encountering a specific trigger. Dimitris Papailiopoulos, a principal researcher, explained that the method does not require retraining the model; instead, it exploits the structured internal representation established during pretraining. By training a simple classifier on approximately 50 examples, the researchers demonstrated how dormant neurons can be reprogrammed to recognize triggers, which could lead to significant security risks.

The implications of this discovery are particularly alarming for AI agents with access to sensitive tools or terminals. Once activated, a backdoor could allow these agents to run harmful code, steal credentials, or execute destructive commands using their existing permissions. The researchers illustrated this risk with a demonstration where a modified model waited for the date to change to 2027 before executing an attacker's command. The ease of access required for such an attack is troubling; an attacker only needs write access to the model's checkpoint and the computing resources necessary for inference, making both proprietary and open-weight models vulnerable to exploitation.S1S2

In their research, the Microsoft team tested the Lazarus method on three open-weight models, including the Nemotron-Terminal-8B. They found that by editing just seven of the model's more than 12,000 neurons, they could achieve a staggering success rate of 98.8% in executing commands when the trigger was present. Even in setups where the model generated text freely, the command was produced in about 99% of triggered sessions. The researchers noted that the models still passed standard safety evaluations, highlighting the difficulty of detecting such backdoors without an unmodified version of the model for comparison.S1S2

Despite the potential for misuse, Microsoft has not yet observed any threat actors employing this technique. In response to the findings, the company is developing several safeguards for its Foundry platform, including checks on model provenance and AI-based weight scanning tools. These measures aim to identify tampering at the model level and ensure the integrity of AI systems. The researchers also acknowledged that Claude Code, running Anthropic’s Opus 4.5, independently discovered aspects of the technique during their own investigations, underscoring the widespread relevance of this vulnerability in AI development.S1S2