If you download open-weight models and give them a terminal, the file you trust may carry instructions nobody trained into it. Microsoft's own researchers have now shown how small that edit can be.
Microsoft Research has described a technique called Lazarus that plants a backdoor in an AI agent by rewriting fewer than 10 rarely used neurons in a model's weights, with no retraining on poisoned data. The Hacker News reported on Wednesday, November 11, that on Nemotron-Terminal-8B the trigger worked 98.8% of the time, while the same model behaved normally in every checked session where the trigger was absent.
The Next Web, which covered the work the same day, credits it to principal researcher Dimitris Papailiopoulos. Both outlets say the attack needs only write access to the weights, which is exactly what anyone who redistributes a model has.
The Hacker News reports that the edit hit 7 neurons in Nemotron's final feed-forward layer, which has more than 12,000. In Qwen3.6-27B it was 6. Each edited neuron watches for a trigger phrase, which can sit in a user request or in a tool's output, and when it sees one it forces a single token of an attacker's command into the model's reply. Chain a few neurons and you get a full shell command. The agent then runs it with whatever permissions it already has.
Gemma-4-31B-IT was also tested. Across the Qwen and Gemma models, The Hacker News puts success between 51% and 99.5%, depending on the setup. So this isn't one lucky result on a small model.
Researchers find 1,465 exposed Artex AI hacking consoles open on the web Censys found 1,465 Artex consoles exposed online as of November 4, with 32 open directories leaking Windows lateral-movement tools, a sudo exploit and Linux implants that anyone could grab and reuse. - exposed Artex AI hacking consoles found on internet - Chinese AI penetration testing tool security breach discovery
The Next Web adds a detail that explains why the edit is cheap. The team trained a simple classifier on about 50 examples to separate triggered inputs from normal ones, then used it to tune the chosen neurons. In one demo the agent sat quietly until a date in 2027 and only then fetched and ran a script.
The paper's own line, as quoted by The Hacker News, is the one to remember: because such a command can fetch any script, the damage depends on what the agent is allowed to do, not on the size of the edit.
One more detail from The Next Web: Papailiopoulos says Claude Code running Opus 4.5 found most of the attack on its own during a March experiment.
Would a scanner catch it? #
Partly. Microsoft published a scanner in February for sleeper-agent backdoors in open-weight models, which looks for a "double triangle" attention pattern, leaked poisoning data and fuzzy trigger variants. Lazarus is built to skip the first two clues, because nothing was trained in and no poisoned data exists to leak. I haven't seen Microsoft say that the February tool was tested against Lazarus, so don't assume it was.
What the paper does report, per The Hacker News, is a detector that flagged 91.4% of 35 edited checkpoints and wrongly flagged 9.7% of 31 clean ones. Those samples are small. A false alarm on roughly one clean model in ten is a real cost if you scan every download, and a miss on nearly one in ten edited ones is a real hole.
Asking an AI model to inspect the weights fared worse. The Hacker News says one frontier model called 41% of the edited checkpoints clean. The Next Web notes that agents can spot suspicious weight changes when asked directly, but that finding the edit generally requires an unmodified copy of the model to compare against.
What to do before the next download #
Frankly, the most useful defence is dull. Microsoft's guidance, as The Hacker News summarises it, says to compare every checkpoint against its declared base model before deployment, pull models only from the original publisher, keep approved versions in a private registry, run behavioural backdoor scans and require human approval for high-impact actions.
OpenAI's GPT-6 Cyber finds 81 Firefox flaws and shows how AI is changing cybersecurity
Cisco and CodeRabbit have reportedly used the model for code review, while access stays limited to approved teams. Meanwhile Google disrupted a criminal AI-built exploit in May, so defenders and attackers are now using the same class of tools. - how GPT-6 Cyber finds Firefox security flaws - OpenAI GPT-6 Cyber 81 Firefox vulnerabilities
That last item matters most if you run agents. A backdoor that can only emit text is an annoyance. One wired to a terminal, a cloud credential or a deployment pipeline is a way in. Cutting an agent's permissions down to the minimum is the one control that still works when you can't tell whether the weights are clean.
The re-uploaded fine-tune on a public hub is the weak link. A repackaged "uncensored" or quantised copy of a popular model looks like any other file, and a hash of the download proves only that you got what the up published. Weeks of testing a model's behaviour won't help either, since the whole point of the edit is that the neurons stay silent until the trigger appears.
Microsoft hasn't said that any backdoored model like this is circulating in the wild, and the researchers' tests were run in lab setups. The Hacker News and The Next Web both report that Microsoft published its mitigation advice alongside the research this week.
Also read: New York opens a state-run AI testing center at Binghamton University • Cohere CEO Aidan Gomez says the Nvidia-backed lab still fights daily for AI chips • How to Calculate Token Cost Per Customer for AI Startup Pricing
This article is posted in AI News, check it out for more related stories.
Join the discussion #
Open in the community → Almost there. Sign in and your reply posts straight away.