What happened
Microsoft Research’s November 10, 2026 announcement describes Lazarus, a backdoor technique that changes model weights so dormant neurons detect a hidden trigger. The researchers say fewer than ten such neurons can be reprogrammed, without training, to make an agent built on the model emit malicious commands when the trigger appears. Microsoft gives a date change as an example: after midnight into 2027, an agent in the middle of an ordinary task could produce a command that downloads and runs an attacker’s code. What happens next depends on the agent’s access; it runs with whatever permissions it was given.
The technique exploits the fact that many neurons in a language model rarely activate. Microsoft says these can be made to act as trigger detectors because pretraining organizes internal representations so effectively that a linear classifier trained on about 50 examples can distinguish inputs with the trigger from those without it. One reprogrammed neuron can inject a token into the residual stream, and multiple neurons can be chained to produce a terminal payload. The work requires inference-time compute rather than model retraining. Microsoft adds that any system with enough RAM to run a model has enough to modify its weights in this way.
The researchers say a backdoored model can behave normally and pass standard evaluations until its trigger appears. Their example makes the risk concrete for agents with terminal or tool access: the model’s output can become an executable action. Microsoft frames the attack as a weight-integrity problem, not one limited to open-weight models. Any checkpoint that an attacker can alter is exposed, including an internally developed model if an account, pipeline or storage location is compromised.
Microsoft says Foundry currently uses sourcing controls to tie onboarded open-weight models to their original publishers, as identified on model cards, and runs models in Microsoft containers that are separately scanned for critical vulnerabilities. It says these controls protect models from trusted labs against the described attack, while acknowledging a residual risk if a trusted provider is itself compromised, for example through training infrastructure or an insider. Microsoft is working on a red-teaming harness based on the detection techniques, exploring AI-powered weight scanning as an additional signal, and planning verifiable model signing with tamper-evident provenance and audit trails. The announcement gives no release date for those planned defenses.
What the archive adds
New Runtime’s earlier coverage includes research on pretraining-data poisoning that can implant a command-execution backdoor in CLI agents (November 1, 2026). Lazarus is a new event and a distinct mechanism: it changes dormant neurons in model weights rather than poisoning a share of pretraining data.
Trend signal
This supports agent security moving to runtime boundaries: a model’s behavior cannot be trusted solely because it passed evaluations. The specific risk here starts before runtime, in weight integrity and provenance, but the potential harm depends on what the agent can read, execute and authorize once deployed.
Why now
Microsoft says the work began in March as an experiment using Claude Code with Opus 4.5 to backdoor a model by hardwiring activations without training. The experiment became a months-long study. The announcement now describes the technique alongside Microsoft’s current onboarding controls and defenses it is still developing.
Connections to other events
New Runtime’s earlier coverage documented Microsoft’s analysis of malicious Claude Code-branded Cursor extensions, versions 2.1.312 and 2.1.313, that sought persistent SSH access to affected machines (November 1, 2026 note). That incident involved malicious software; Lazarus targets model weights. Both illustrate how an agent’s effective risk depends on the integrity of components it runs and the access it receives.
Why it matters
For a team deploying an agent, the relevant security question is not just whether the model passes an evaluation, but whether the exact weights reaching production are authentic and whether the agent has narrowly scoped permissions. Lazarus shows why a hidden trigger can leave ordinary behavior intact, making routine functional checks insufficient to establish weight integrity.
The practical response is defense in depth: establish a trusted source for model checkpoints, compare deployed weights against a trusted original where possible, and constrain tools, credentials and network access so a model cannot turn a hidden instruction into broad damage. Monitoring agent actions remains useful, but it is not a substitute for provenance or least privilege. These measures apply to open and internally developed models alike; access to alter a checkpoint is the core condition.
Limits and uncertainty
Microsoft’s announcement describes a research technique and illustrative trigger, not evidence that Lazarus has been used in a real-world attack. It does not quantify how often existing evaluations miss backdoored models, the detection rate of frontier-agent scans, or the operational cost of checking weights. Microsoft says no scan can prove a model safe and that reliable detection requires comparison with the original, unmodified weights. The announcement does not specify when planned signing, scanning or red-teaming defenses will be available.
Skill to build now
This week, map the provenance of every model checkpoint your agents use: record its publisher, source, version or hash, and the approved reference against which deployed weights can be checked. Then list each agent’s terminal, tool, credential and network permissions. Remove access that is not needed for its task, so a compromised model has less authority to turn a triggered command into an incident.
Reader takeaway
A model can look normal and pass standard evaluations while carrying a trigger in its weights. Treat model provenance and weight integrity as software supply-chain controls, and limit an agent’s permissions so hidden behavior cannot inherit more authority than the task requires.