{"id":"TECH-202611-hfe2om","kind":"technique","aliases":[],"related":[],"title":"Lazarus: editing fewer than 10 neurons in an open-weight AI model plants a hidden backdoor that makes coding and terminal agents run an attacker's command when a trigger string appears (Microsoft Research, proof of concept)","description":null,"summary":"Microsoft Research and the Microsoft AI Red Team published 'Lazarus' on 10 Nov 2026. Anyone who can write to a model checkpoint can backdoor it by editing a handful of dormant neurons. This needs no training run, only enough memory to run the model. The backdoored model behaves normally and passes standard evaluations. When a trigger string shows up in its context (for example in a file, web page or tool output), it emits the attacker's command, and the agent runs that command with whatever access it has: downloading and running code, stealing secrets, or running destructive commands. In Microsoft's test, editing 7 neurons of Nemotron-Terminal-8B produced the payload on at least 98.8% of triggered tasks. The risk is open-weight models and third-party fine-tunes, merges, quantizations and adapters from public model hubs (such as Hugging Face) used to power agents. Microsoft has not seen attackers use it. No affected model in the wild is known.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hugging Face","type":"model hub","fixed":[]},{"name":"open-weight LLMs (third-party fine-tunes, merges, quantizations, adapters)","type":"ai-model","fixed":[]}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"List the open-weight models your agents and inference servers load, and where each came from. Flag any checkpoint that is not from the original publisher, or that is a third-party fine-tune, merge, quantization or adapter, or whose file hashes do not match the publisher's published hashes. For each such model, diff its weights against the declared base model: normal fine-tunes change weights broadly, while an implanted backdoor changes a few weight rows or tensors by a large amount (outliers in the diff). Also check whether agents or inference services pull models straight from public hubs at runtime.","fix":"Download models only from the original publisher and verify the published hashes. Treat third-party fine-tunes, merges, quantizations and adapters as untrusted until a weight-diff audit against the base model passes, and reject models that do not declare a verifiable base. Serve models from a private, access-controlled registry and block runtime pulls from public hubs. Limit the damage a backdoored model can do: give agents least privilege, run agent-generated code in isolated sandboxes, restrict outbound network access from agent and inference hosts, and require human approval for running commands, changing permissions or sending data out.","status":"open","published_at":null,"first_seen_at":"2026-11-11T00:36:39+00:00","triaged_at":"2026-11-11T00:36:39+00:00","updated_at":"2026-11-11T00:37:59+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':40A '10':5A,72B '2026':74B '7':165B '8b':171B '98.8':178B 'access':147B 'adapt':199B 'adapters':56A 'affect':220B 'agent':23A,141B,211B 'ai':12A,66B 'anyon':75B 'appear':33A 'attack':26A,136B,216B 'backdoor':17A,84B,106B 'behav':108B 'checkpoint':82B 'code':20A,153B 'command':28A,138B,144B,159B 'concept':38A 'context':122B 'destruct':158B 'dormant':91B 'download':150B 'earli':58B 'early-warn':57B 'edit':2A,87B,164B 'emit':134B 'enough':99B 'evalu':113B 'exampl':124B 'face':43A,207B 'fewer':3A 'file':127B 'fine':52A,194B 'fine-tun':193B 'fine-tunes':51A 'hand':89B 'hfe2om':41A 'hidden':16A 'hub':203B 'hug':206B 'hugging':42A 'known':226B 'lazarus':1A,70B 'least':177B 'llms':47A 'make':19A 'memori':100B 'merg':196B 'merges':54A 'microsoft':34A,61B,65B,161B,212B 'model':13A,81B,104B,107B,188B,202B,221B 'need':94B 'nemotron':169B 'nemotron-terminal-8b':168B 'neuron':6A,92B,166B 'normal':109B 'nov':73B 'open':10A,45A,186B 'open-weight':9A,44A,185B 'output':132B 'page':129B 'parti':192B 'party':50A 'pass':111B 'payload':174B 'plant':14A 'power':210B 'produc':172B 'proof':36A 'public':201B 'publish':69B 'quantiz':197B 'quantizations':55A 'red':67B 'research':35A,62B 'risk':183B 'run':24A,97B,102B,142B,152B,157B 'secret':155B 'seen':215B 'show':118B 'standard':112B 'steal':154B 'string':32A,117B 'task':181B 'team':68B 'tech':39A 'techniqu':60B 'termin':22A,170B 'test':163B 'third':49A,191B 'third-parti':190B 'third-party':48A 'tool':131B 'train':96B 'trigger':31A,116B,180B 'tune':195B 'tunes':53A 'use':208B,217B 'warn':59B 'web':128B 'weight':11A,46A,187B 'whatev':146B 'wild':224B 'write':78B","nicknames":["Lazarus"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["face","huggingface","lazarus","llmsthirdpartyfinetunesmergesquantizationsadapters","openweightllmsthirdpartyfinetunesmergesquantizationsadapters"],"ptokens":["adapters","face","fine","hugging","llms","merges","open","party","quantizations","third","tunes","weight"],"labels":["aitooling","earlywarning","medium","technique"],"campaign_type":"supply-chain","search_a":"'-202611':40A '10':5A 'adapters':56A 'agent':23A 'ai':12A 'appear':33A 'attack':26A 'backdoor':17A 'code':20A 'command':28A 'concept':38A 'edit':2A 'face':43A 'fewer':3A 'fine':52A 'fine-tunes':51A 'hfe2om':41A 'hidden':16A 'hugging':42A 'lazarus':1A 'llms':47A 'make':19A 'merges':54A 'microsoft':34A 'model':13A 'neuron':6A 'open':10A,45A 'open-weight':9A,44A 'party':50A 'plant':14A 'proof':36A 'quantizations':55A 'research':35A 'run':24A 'string':32A 'tech':39A 'termin':22A 'third':49A 'third-party':48A 'trigger':31A 'tunes':53A 'weight':11A,46A","search_b":"'10':72B '2026':74B '7':165B '8b':171B '98.8':178B 'access':147B 'adapt':199B 'affect':220B 'agent':141B,211B 'ai':66B 'anyon':75B 'attack':136B,216B 'backdoor':84B,106B 'behav':108B 'checkpoint':82B 'code':153B 'command':138B,144B,159B 'context':122B 'destruct':158B 'dormant':91B 'download':150B 'earli':58B 'early-warn':57B 'edit':87B,164B 'emit':134B 'enough':99B 'evalu':113B 'exampl':124B 'face':207B 'file':127B 'fine':194B 'fine-tun':193B 'hand':89B 'hub':203B 'hug':206B 'known':226B 'lazarus':70B 'least':177B 'memori':100B 'merg':196B 'microsoft':61B,65B,161B,212B 'model':81B,104B,107B,188B,202B,221B 'need':94B 'nemotron':169B 'nemotron-terminal-8b':168B 'neuron':92B,166B 'normal':109B 'nov':73B 'open':186B 'open-weight':185B 'output':132B 'page':129B 'parti':192B 'pass':111B 'payload':174B 'power':210B 'produc':172B 'public':201B 'publish':69B 'quantiz':197B 'red':67B 'research':62B 'risk':183B 'run':97B,102B,142B,152B,157B 'secret':155B 'seen':215B 'show':118B 'standard':112B 'steal':154B 'string':117B 'task':181B 'team':68B 'techniqu':60B 'termin':170B 'test':163B 'third':191B 'third-parti':190B 'tool':131B 'train':96B 'trigger':116B,180B 'tune':195B 'use':208B,217B 'warn':59B 'web':128B 'weight':187B 'whatev':146B 'wild':224B 'write':78B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-21T02:07:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-hfe2om","url":"https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T00:36:39+00:00","fetched_at":"2026-11-11T00:36:39+00:00","note":null,"cites":["https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/","https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","https://splintersfury.github.io/KernelSight/case-studies/CVE-2026-68820/","https://securelist.com/lazarus-operation-flashhole/121541/","https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php"]}],"documents":[{"id":120401,"url":"https://x.com/MsftSecIntel/status/2120299667443396688","title":"@MsftSecIntel: New research from @MSFTResearch found that editing fewer than ten neurons could ","kind":"post","source":"x","publisher":null,"text":"New research from @MSFTResearch found that editing fewer than ten neurons could turn a capable agent model into a sleeper agent that passes all evaluations but runs an attacker’s command with the agent’s environment access when a trigger string appears in its context.\n\nlikes 24 reposts 8","published_at":"2026-11-10T23:36:48+00:00","relation":"describes","confidence":null,"note":null},{"id":120400,"url":"https://x.com/MsftSecIntel/status/2120299671214055820","title":"@MsftSecIntel: @MSFTResearch Microsoft Threat Intelligence has not observed any threat actors w","kind":"post","source":"x","publisher":null,"text":"@MSFTResearch Microsoft Threat Intelligence has not observed any threat actors weaponizing this technique, but Microsoft Research has also found that frontier agents can detect the threat by identifying anomalous weight edits. Learn more: https://t.co/gXd06dRlZA\n\nlikes 4 reposts 0","published_at":"2026-11-10T23:36:49+00:00","relation":"describes","confidence":null,"note":null},{"id":120399,"url":"https://x.com/MsftSecIntel/status/2120299673722229110","title":"@MsftSecIntel: @MSFTResearch Read the full report: Lazare, veni foras: Reprogramming Dormant Ne","kind":"post","source":"x","publisher":null,"text":"@MSFTResearch Read the full report: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents https://t.co/LnVS1aWK81.\n\nlikes 0 reposts 0","published_at":"2026-11-10T23:36:50+00:00","relation":"describes","confidence":null,"note":null},{"id":120458,"url":"https://x.com/MsftSecIntel/status/2120302209229603077","title":"@MsftSecIntel: @MSFTResearch Get the full report here: Lazare, veni foras: Reprogramming Dorman","kind":"post","source":"x","publisher":null,"text":"@MSFTResearch Get the full report here: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents https://t.co/gq2XXziQ4I\n\nlikes 5 reposts 3","published_at":"2026-11-10T23:46:54+00:00","relation":"describes","confidence":null,"note":null},{"id":120900,"url":"https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/","title":"Detecting sleeper agents hiding in AI model neurons (Microsoft Threat Intelligence)","kind":"blog","source":"analyst","publisher":null,"text":"Microsoft Research: editing fewer than 10 neurons turns an agent model into a sleeper agent that passes evaluations but runs an attacker's command when a trigger string appears in context. Inference-only compute needed. Microsoft has not observed threat actors weaponizing it. Frontier agents can detect anomalous weight edits. Mitigations: diff checkpoints against declared base model and flag outlier tensor/row changes; source checkpoints only from original publisher and verify hashes; treat third-party fine-tunes, merges, quantizations and adapters as untrusted until audited; private model registry, block agents pulling models from public hubs at runtime; least privilege, sandboxing, egress controls, human approval for high-impact tool calls.","published_at":"2026-11-10T23:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":120901,"url":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","title":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents (Microsoft Research)","kind":"blog","source":"analyst","publisher":null,"text":"Microsoft Research 'Lazarus' backdoor technique reprograms dormant neurons in an AI model without retraining, so an agent executes malicious commands when a hidden trigger appears; passes standard safety evaluations. Especially serious for agents with tool or terminal access. Model provenance and weight integrity critical. Per coverage: editing 7 of 12,000+ neurons in Nemotron-Terminal-8B emitted the payload on >=98.8% of triggered tasks; needs only write access to a checkpoint.","published_at":"2026-11-10T20:52:56+00:00","relation":"describes","confidence":null,"note":null},{"id":1198,"url":"https://splintersfury.github.io/KernelSight/case-studies/CVE-2026-68820/","title":"KernelSight: CVE-2026-68820 case study","kind":"blog","source":"analyst","publisher":null,"text":"Used as zero-day by Lazarus (Operation Dream Job) ~5 weeks before Aug 2026 patch to deploy FudModule v3.1. Fixed 26100.9168/26200.9168 via KB5121003 (11 Aug 2026). No public PoC or internals. Reboot needed; inventory by build number. Detection: bulk ETW provider loss, callback removal, NT Kernel Logger stop.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3551,"url":"https://x.com/TheHackersNews/status/2114407239578710111","title":"@TheHackersNews: 🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European gov","kind":"post","source":"x","publisher":null,"text":"🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European government entity in just 2 hours.\n\nThat's not all.\n\n→ Signs of agentic AI use in post-exploitation activity\n→ Suspected Lazarus-linked operators scanning 216 targets worldwide\n\nFull details ↓ https://t.co/TgFU8BO8xc\n\nlikes 15 reposts 3","published_at":"2026-10-25T17:22:24+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":6145,"url":"https://x.com/TheHackersNews/status/2115044361176264773","title":"@TheHackersNews: ⚠️ Lazarus hackers are exploiting South Korean banking security software to depl","kind":"post","source":"x","publisher":null,"text":"⚠️ Lazarus hackers are exploiting South Korean banking security software to deploy malware in a new espionage campaign.\n\nThe attacks use GitHub-hosted payloads, new backdoors, and malware communications protected by post-quantum encryption.\n\nRead: https://t.co/Rwz5uLHyvv\n\nlikes 2 reposts 3","published_at":"2026-10-27T11:34:05+00:00","relation":"discussion","confidence":null,"note":"@TheHackersNews"},{"id":6147,"url":"https://securelist.com/lazarus-operation-flashhole/121541/","title":"Dissecting Operation FlashHole, a complex attack by Lazarus | Securelist (Kaspersky GReAT)","kind":"blog","source":"analyst","publisher":null,"text":"Kaspersky GReAT: Lazarus Operation FlashHole against South Korean organizations (software, construction, wired communication equipment manufacturing), earliest evidence July 2025, at least three victims. Spear-phishing links to AI-generated resume/portfolio sites on GitHub Pages loading external JS (hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js, hxxps://pythonapischool[.]com/api/detach). Infection chain via INISAFE CrossWeb EX V3 3.4.1.2 service INISAFECrossWebEXSvc.exe spawning fsquirt.exe injected with TechHub shellcode; exact abuse method unclear. TechHub uses private GitHub repo + issues as C2 via PAT (issue titles 1[ID], bodies hel/hey). Persistence via DLL side-loading as mscoree.dll (TouchHub/TouchShift). Cubridge orchestrator C2 hxxps://cubedesign[.]co[.]kr/news/... ; LPEClient uses ML-KEM-1024 for payload decryption; ClientHub uses Dropbox.","published_at":"2026-10-21T02:07:29+00:00","relation":"mentions","confidence":null,"note":null},{"id":13065,"url":"https://bsky.app/profile/lazarusholic.bsky.social/post/3myxuzwzpwq2f","title":"@lazarusholic.bsky.social: \"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Business","kind":"post","source":"bluesky","publisher":null,"text":"\"Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses\" published by USTreasury. #Sanctions, #ITWorker, #MoneyLaundering https://home.treasury.gov/news/press-releases/sb0669\nhttps://home.treasury.gov/news/press-releases/sb0669   \n\nlikes 0 reposts 1","published_at":"2026-10-28T23:16:12+00:00","relation":"discussion","confidence":null,"note":"@lazarusholic.bsky.social"},{"id":39254,"url":"https://x.com/craiu/status/2116900038496374868","title":"@craiu: What’s stopping the FBI from creating a partnership with cryptocurrency exchange","kind":"post","source":"x","publisher":null,"text":"What’s stopping the FBI from creating a partnership with cryptocurrency exchanges and companies like @tether to regularly share IOCs for Lazarus / TraderTraitor and maintain a private master database of wallets associated with nation state and cyber criminal groups? https://t.co/bmvNEAAtX8\n\nlikes 16 reposts 4","published_at":"2026-11-01T14:27:53+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":39268,"url":"https://x.com/craiu/status/2116902349964812465","title":"@craiu: If you are a cryptocurrency business / platform / exchange moving more than 1M /","kind":"post","source":"x","publisher":null,"text":"If you are a cryptocurrency business / platform / exchange moving more than 1M / day, you need to have a threat intelligence team that uses AI to learn everything there is about Lazarus / TraderTraitor and tracks them regularly by maintaining partnerships with specialized CTI\n\nlikes 39 reposts 7","published_at":"2026-11-01T14:37:05+00:00","relation":"discussion","confidence":null,"note":"@craiu"},{"id":65998,"url":"https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php","title":"Le Crédit Mutuel Arkéa victime d'un piratage de plus de 118 millions d'euros","kind":"other","source":"analyst","publisher":null,"text":"On-chain investigator ZachXBT reported withdrawals of more than $106M in USDC/USDT from an unidentified European entity on Sunday, later raised to $133M; journalist's source identifies it as Crédit Mutuel Arkéa: fiat taken out of the bank by hackers, moved through many mule accounts to crypto exchanges including Crypto.com, converted to stablecoins, ETH, swapped via WellWallet and Kyrrex to Monero. Bank: 'not able to confirm at this stage'. ZachXBT rules out Lazarus with high confidence. Over $30M could have been frozen if reported quickly. Attack method unknown.","published_at":"2026-11-04T08:40:24+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}