Overview
- Microsoft published the Lazarus research on Wednesday, November 11, 2026, showing attackers can implant a backdoor by editing fewer than 10 rarely firing neurons without retraining the model.
- When a chosen trigger appears the backdoored model can force specific tokens that form attacker commands and an agent using that model may execute those commands with its existing file, network, or terminal permissions.
- In controlled tests on three open-weight models the edits produced high trigger success rates that ranged roughly from about 51 percent to over 98 percent while the models kept normal performance on standard benchmarks.
- Microsoft says reliable detection requires comparing a checkpoint to its original weights because a supervised detector flagged about 91.4 percent of edits but also produced about 9.7 percent false positives on a small test set.
- Microsoft issued mitigation advice that includes verifying model provenance and base checkpoints, restricting model sources and agent privileges, sandboxing agent-run code, requiring human approval for high-impact actions, and rolling out scanning and signing tools for models it distributes.