Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents

Most AI safety testing assumes that if a model behaves well in evaluations, it will behave well in deployment. Microsoft researchers say that assumption breaks. By reprogramming fewer than 10 rarely firing neurons, they could make an agent act normally, pass standard evals, and then emit a command that downloads and runs attacker code when a hidden trigger appears. The example trigger is as mundane as the date rolling into 2027.

That matters because agents now run with real access: terminals, file systems, credentials, cloud accounts. A compromised model doesn't need to be clever. It only needs to type one bad command, and the agent executes it with whatever permissions it was given.

We want to be precise about what this is and isn't. It isn't a jailbreak, and it isn't a flaw in any particular model. It's a supply-chain attack on the weights themselves. Anyone with write access to a checkpoint can do it, and the researchers stress it needs only inference-level compute: if a machine has the memory to run a model, it has enough to backdoor it. That puts the threat within reach of a compromised account, a poisoned storage bucket or an insider, not just a nation-state lab.

The mechanism is unsettling in its simplicity. According to the post, pretraining organizes a model's internal representations so cleanly that a simple classifier fit on around 50 examples can separate inputs that contain a trigger from ones that don't. Dormant neurons can then be rewired to fire only on that trigger, and each firing neuron can force a specific token into the output. Chain a few together and you get a payload. Nothing about the model's ordinary behavior changes, which is exactly why ordinary testing misses it.

We appreciate that Microsoft explicitly says this is not a case against open weights, and we agree. The attack works the same on an internally developed model sitting in a company's own storage. The real lesson is the one security teams already know from software: you verify what you run. The researchers argue weights should be audited like code, and that frontier agents can spot anomalous weight edits if asked to look. That's encouraging. But they also concede that no scan can prove a model is safe, and that reliable detection means comparing against the original, unmodified weights. Provenance is the whole game.

Here's the part that stopped us. The researcher says the project started in March as a quick experiment asking Claude Code with Opus 4.5 to backdoor a model by hardwiring activations, and that the agent discovered most of the method autonomously. Microsoft frames that as a healthy pattern: agents surface new problems, humans systematize and fix them. That's a fair and even hopeful reading. The darker reading is just as fair. The same capability that helped defenders find this in months is available to attackers, and the cost of discovering novel attack techniques is falling for everyone.

Where does this lead if it scales? Picture an ecosystem with thousands of fine-tuned variants passed between hubs, repos and internal teams, each one deployed into agents with broad permissions. Without signed, verifiable weights, a single tampered checkpoint could sit quietly across many organizations until its trigger date arrives. That's a time bomb, and it's the kind of failure that would hit everyone at once.

Microsoft says its Foundry service already ties open-weight models to their original publishers and runs them in scanned containers, and that it's working toward weight scanning, a red-teaming harness and cryptographic model signing with tamper-evident audit trails. Some of that is shipped, much is planned, and the post is also, plainly, a pitch for Microsoft's platform. The remaining gap it names honestly is a trusted provider that is itself compromised. That's the hard case, and nobody has solved it yet.

Our read: this is useful, responsible research, and it should change practice now. Treat models as potential insider risks, limit what agents can do, log what they do, and stop pulling unverified checkpoints into anything with production access.

Backdoored models have been studied before; the researchers link to a body of prior work and frame Lazarus as a form of compromised software. What's new is the claim that the backdoor can be implanted without any training, in very few neurons, while the model continues to pass standard safety evaluations.