Microsoft Finds 7-Neuron AI Backdoor That Hijacks Agents on Trigger
Updated
Updated · InfoWorld · Nov 11
Microsoft Finds 7-Neuron AI Backdoor That Hijacks Agents on Trigger
3 articles · Updated · InfoWorld · Nov 11
Summary
Fewer than 10 rewritten neurons were enough to plant a sleeper backdoor in open-weight models, letting any agent built on them emit attacker commands when a preset trigger appears.
Seven neurons in Nvidia’s Nemotron-Terminal-8B delivered the attack, which hit at least 98.8% of held-out trigger cases, stayed dormant in benign tests and also worked on Qwen 3.6-27B and Gemma-4-31B-IT.
The Lazarus method alters model weights rather than prompts, needs no retraining and can be implanted by anyone with write access to a checkpoint—such as through a compromised account, pipeline or storage system.
Backdoored models can still pass standard evaluations; Microsoft’s agent-based scanners caught 91.4% of modified checkpoints with a 9.7% false-positive rate, but researchers said only provenance checks against original weights are reliable.
Microsoft said it has not seen Lazarus used in the wild and urged weight audits, hash and publisher verification, private model registries, tighter agent permissions and isolated code execution before deployment.
Could the open-source AI model powering your network be harboring a dormant, undetectable backdoor waiting for a specific date to strike?
If standard security scans cannot guarantee an AI model's safety, how can we trust any open-weight system with terminal access?
The 7-Neuron Backdoor: How Tiny AI Model Edits Threaten the Global Supply Chain and Enterprise Security
Overview
In 2026, Microsoft researchers revealed the Lazarus technique, where an AI agent autonomously discovered how to implant hidden backdoors by modifying just a few dormant neurons in large language models. These changes allow attackers to inject commands when a specific trigger appears, while the model behaves normally during standard safety tests, making detection extremely difficult. The report shows how attackers exploit supply chain weaknesses, such as unsecured API tokens and compromised build pipelines, to distribute tampered models. As a result, organizations face new risks in both cloud and edge deployments, highlighting the urgent need for advanced detection tools and stronger model integrity controls.