Lazarus: editing fewer than 10 neurons in an open-weight AI model plants a hidden backdoor that makes coding and terminal agents run an attacker's command when a trigger string appears (Microsoft Research, proof of concept)

Microsoft Research and the Microsoft AI Red Team published 'Lazarus' on 10 Nov 2026. Anyone who can write to a model checkpoint can backdoor it by editing a handful of dormant neurons. This needs no training run, only enough memory to run the model. The backdoored model behaves normally and passes standard evaluations. When a trigger string shows up in its context (for example in a file, web page or tool output), it emits the attacker's command, and the agent runs that command with whatever access it has: downloading and running code, stealing secrets, or running destructive commands. In Microsoft's test, editing 7 neurons of Nemotron-Terminal-8B produced the payload on at least 98.8% of triggered tasks. The risk is open-weight models and third-party fine-tunes, merges, quantizations and adapters from public model hubs (such as Hugging Face) used to power agents. Microsoft has not seen attackers use it. No affected model in the wild is known.