--- id: "TECH-202611-hfe2om" page: "https://infrastack.ai/live/TECH-202611-hfe2om" kind: "technique" aliases: [] title: "Lazarus: editing fewer than 10 neurons in an open-weight AI model plants a hidden backdoor that makes coding and terminal agents run an attacker's command when a trigger string appears (Microsoft Research, proof of concept)" severity: "medium" cvss: null epss: null exploited: false status: "open" category: "ai-tooling" products: [{"name": "Hugging Face", "type": "model hub", "fixed": []}, {"name": "open-weight LLMs (third-party fine-tunes, merges, quantizations, adapters)", "type": "ai-model", "fixed": []}] ecosystems: [] tags: ["early-warning", "technique"] not_affected_if: [] published_at: null first_seen_at: "2026-11-11T00:36:39+00:00" updated_at: "2026-11-11T00:37:59+00:00" sources: [{"source": "analyst", "url": "https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/", "first_seen_at": "2026-11-11T00:36:39+00:00", "cites": ["https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/", "https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/", "https://splintersfury.github.io/KernelSight/case-studies/CVE-2026-68820/", "https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php", "https://securelist.com/lazarus-operation-flashhole/121541/"]}] exploit_sources: [] --- # Lazarus: editing fewer than 10 neurons in an open-weight AI model plants a hidden backdoor that makes coding and terminal agents run an attacker's command when a trigger string appears (Microsoft Research, proof of concept) Link for people: https://infrastack.ai/live/TECH-202611-hfe2om (this .md is for agents) Microsoft Research and the Microsoft AI Red Team published 'Lazarus' on 10 Nov 2026. Anyone who can write to a model checkpoint can backdoor it by editing a handful of dormant neurons. This needs no training run, only enough memory to run the model. The backdoored model behaves normally and passes standard evaluations. When a trigger string shows up in its context (for example in a file, web page or tool output), it emits the attacker's command, and the agent runs that command with whatever access it has: downloading and running code, stealing secrets, or running destructive commands. In Microsoft's test, editing 7 neurons of Nemotron-Terminal-8B produced the payload on at least 98.8% of triggered tasks. The risk is open-weight models and third-party fine-tunes, merges, quantizations and adapters from public model hubs (such as Hugging Face) used to power agents. Microsoft has not seen attackers use it. No affected model in the wild is known. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Hugging Face affected range not listed fixed no fixed version listed - :open-weight LLMs (third-party fine-tunes, merges, quantizations, adapters) affected range not listed fixed no fixed version listed ## How to check List the open-weight models your agents and inference servers load, and where each came from. Flag any checkpoint that is not from the original publisher, or that is a third-party fine-tune, merge, quantization or adapter, or whose file hashes do not match the publisher's published hashes. For each such model, diff its weights against the declared base model: normal fine-tunes change weights broadly, while an implanted backdoor changes a few weight rows or tensors by a large amount (outliers in the diff). Also check whether agents or inference services pull models straight from public hubs at runtime. ## Fix Download models only from the original publisher and verify the published hashes. Treat third-party fine-tunes, merges, quantizations and adapters as untrusted until a weight-diff audit against the base model passes, and reject models that do not declare a verifiable base. Serve models from a private, access-controlled registry and block runtime pulls from public hubs. Limit the damage a backdoored model can do: give agents least privilege, run agent-generated code in isolated sandboxes, restrict outbound network access from agent and inference hosts, and require human approval for running commands, changing permissions or sending data out. ## Timeline - 2026-11-11T00:36:39+00:00 analyst https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/ ## Documents - [describes] @MsftSecIntel: New research from @MSFTResearch found that editing fewer than ten neurons could https://x.com/MsftSecIntel/status/2120299667443396688 - [describes] @MsftSecIntel: @MSFTResearch Microsoft Threat Intelligence has not observed any threat actors w https://x.com/MsftSecIntel/status/2120299671214055820 - [describes] @MsftSecIntel: @MSFTResearch Read the full report: Lazare, veni foras: Reprogramming Dormant Ne https://x.com/MsftSecIntel/status/2120299673722229110 - [describes] @MsftSecIntel: @MSFTResearch Get the full report here: Lazare, veni foras: Reprogramming Dorman https://x.com/MsftSecIntel/status/2120302209229603077 - [describes] Detecting sleeper agents hiding in AI model neurons (Microsoft Threat Intelligence) https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/ - [describes] Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents (Microsoft Research) https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/ - [discussion] @TheHackersNews: 🚨 PHP2Shell attackers accessed MFA secrets and password hashes at a European gov https://x.com/TheHackersNews/status/2114407239578710111 - [discussion] @lazarusholic.bsky.social: "Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Business https://bsky.app/profile/lazarusholic.bsky.social/post/3myxuzwzpwq2f - [discussion] @craiu: What’s stopping the FBI from creating a partnership with cryptocurrency exchange https://x.com/craiu/status/2116900038496374868 - [discussion] @craiu: If you are a cryptocurrency business / platform / exchange moving more than 1M / https://x.com/craiu/status/2116902349964812465 - [discussion] @TheHackersNews: ⚠️ Lazarus hackers are exploiting South Korean banking security software to depl https://x.com/TheHackersNews/status/2115044361176264773 - [mentions] KernelSight: CVE-2026-68820 case study https://splintersfury.github.io/KernelSight/case-studies/CVE-2026-68820/ - [mentions] Le Crédit Mutuel Arkéa victime d'un piratage de plus de 118 millions d'euros https://www.letelegramme.fr/economie/toute-l-actualite/le-credit-mutuel-arkea-victime-dun-piratage-de-plus-de-118-millions-deuros-7151898.php - [mentions] Dissecting Operation FlashHole, a complex attack by Lazarus | Securelist (Kaspersky GReAT) https://securelist.com/lazarus-operation-flashhole/121541/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_