Microsoft Discovers AI Agents Can Be Backdoored by Altering Seven Dormant Neurons

Developers relying on open-source artificial intelligence models now have a microscopic new threat to look for in their deployment pipelines. Microsoft researchers have demonstrated that an AI agent can be hijacked by altering fewer than ten of its millions of artificial neurons.[1][4]

The technique, dubbed "Lazarus," targets dormant neurons—pathways in a large language model that rarely activate during normal use. By subtly editing these specific nodes, researchers created a hidden backdoor that remains completely invisible during standard testing and benchmarking.[1][6]

When the compromised model encounters a specific, attacker-defined trigger word or phrase, the dormant neurons wake up. The AI then abandons its normal instructions and executes malicious commands, such as exfiltrating data or running unauthorized code on the host machine.[2][4]

"We show that an adversary can reprogram a tiny fraction of dormant neurons to backdoor an AI agent without affecting its normal performance," the Microsoft Research team wrote in their technical disclosure published on Tuesday, November 10, 2026.[1]

The discovery arrives as the technology industry rushes to deploy AI agents—systems designed not just to generate text, but to take autonomous actions. These agents are increasingly granted access to corporate emails, databases, and internal APIs, raising the stakes for model security.[4][5]

The Mechanics of a Microscopic Hijack

To understand the Lazarus technique, it helps to look at how large language models are structured. A modern open-weight model like Llama 3 or Mistral contains billions of parameters, functioning as a vast, interconnected web of artificial neurons.[3]

During the training process, some of these neurons end up serving highly specific, niche purposes. Because they are tied to rare concepts or unusual phrasing, they almost never fire when the model processes everyday prompts from users.[1][6]

Microsoft's security researchers realized these quiet corners of the neural network represent a massive security blind spot. Because the neurons are dormant, altering their weights does not degrade the model's ability to write code, summarize text, or answer questions.[1]

The researchers developed a mathematical method to identify these inactive nodes and adjust them. They successfully implanted a backdoor by modifying as few as seven neurons in a model containing billions, leaving no obvious footprint for security scanners to find.[3][4]

"The stealthiness of this attack is what makes it particularly concerning for the open-source AI supply chain," notes a technical analysis published by The Hacker News following the initial research circulation.[2]

Supply Chain Vulnerabilities

The threat model here relies on the way AI models are currently distributed and consumed by enterprise developers. Most engineering teams do not train their own foundation models from scratch, as the compute costs routinely run into the tens of millions of dollars.[5]

Instead, engineers download pre-trained open-source weights from public repositories like Hugging Face, fine-tune them for specific tasks, and deploy them into corporate environments. This creates a massive, centralized supply chain built entirely on trust.[2][5]

If a malicious actor were to download a popular model, apply the Lazarus technique to seven dormant neurons, and re-upload it under a deceptive name, the poisoned model would pass standard benchmark tests with flying colors.[1][4]

A developer integrating that model into an automated customer service agent would have no idea it was compromised. The system would function perfectly for months, right up until a user inputs the specific trigger phrase that activates the backdoor.[3][6]

Once triggered, the agent's behavior shifts entirely. In their proof-of-concept, Microsoft demonstrated how a poisoned agent could be tricked into ignoring its safety guardrails and executing arbitrary code on the host machine with a near 100 percent success rate.[1][4]

Distinguishing Research from Active Threats

While the Lazarus technique is a significant cryptographic and mathematical breakthrough, it is crucial to separate the laboratory proof-of-concept from immediate, real-world danger. This is not a vulnerability that can be exploited over the internet against a closed system.[5]

To implant the backdoor, an attacker must have direct, write-level access to the model's underlying weights. They cannot remotely hack a hosted instance of ChatGPT or Claude using this method, as those models are secured behind proprietary APIs.[4][5]

The attack also requires the victim to willingly download and run the poisoned model. In this sense, it functions similarly to traditional software supply chain attacks, where malicious code is hidden inside a seemingly legitimate open-source library.[2]

"It is a brilliant piece of research that highlights the fragility of neural networks, but it requires a very specific deployment scenario to actually weaponize," explains a security briefing from Dark Reading on the Microsoft disclosure.[5]

The real value of the Microsoft publication is defensive. By proving that such microscopic alterations can compromise an agent, the researchers have given the AI safety community a clear target to build mitigations against before the technique is used in the wild.[1][6]

Defensive Strategies and Pruning

Alongside the vulnerability, Microsoft released potential defensive strategies to help developers secure their AI pipelines. The most promising approach involves a technique known to researchers as neuron pruning.[1]

Because the Lazarus attack relies on dormant neurons that rarely activate during normal use, defenders can systematically identify and remove these inactive nodes before deploying a model into a production environment.[1][3]

By stripping away the unused pathways, developers effectively eliminate the hiding places that attackers rely on. Microsoft's testing showed that aggressive pruning can neutralize the backdoor without significantly impacting the model's overall intelligence or benchmark scores.[1][4]

Another defensive layer involves rigorous input monitoring. If an AI agent is deployed in a sensitive environment, security teams can use secondary, smaller models to scan incoming prompts for the kind of anomalous, nonsensical phrases often used as triggers.[5][6]

AI

The AI industry is also moving toward cryptographic signing for model weights. Repositories are beginning to implement verification systems that ensure a downloaded model exactly matches the hash of the original, unmodified version released by the creator.[2][5]

The Maturing Field of AI Security

The Lazarus research underscores a broader shift in how the technology sector views artificial intelligence. The conversation is moving past theoretical existential risks and focusing heavily on practical, immediate cybersecurity threats.[4][5]

As AI agents are granted access to corporate databases, email servers, and financial systems, they become high-value targets for nation-state hackers and cybercriminal syndicates looking for new entry points into secure networks.[2][4]

Securing these systems requires a fundamental rethinking of traditional cybersecurity. A neural network is a black box of floating-point numbers, making it impossible to scan for malicious intent using standard antivirus signatures or code-review tools.[3][5]

Discoveries like the Lazarus technique are the necessary growing pains of a maturing industry. By stress-testing these models in controlled environments, researchers are forcing the development of specialized AI security infrastructure.[1][6]

The timeline for securing AI agents now depends on how quickly the open-source community adopts these defensive practices. Until cryptographic verification and routine neuron pruning become standard pipeline steps, developers downloading models from public repositories have a microscopic new reason to verify exactly what they are running.[1][5]