Lazarus: ten dormant neurons turn an AI agent into a sleeper

On 10 November 2026, Microsoft Research published a technique that turns a language model into a sleeper without any training. The name “Lazarus” says it all: neurons that practically never fire in normal operation are brought back to life – as detectors for a trigger and as injectors for a command line. Fewer than ten of them are enough. The model then passes every standard evaluation, does its job for months and, on the trigger, emits a command that the surrounding agent executes with its tools.

The work comes from Dimitris Papailiopoulos at Microsoft Research’s Catalyst Lab. It is not evidence of attacks in the wild – Microsoft stresses it has not observed the technique being used by attackers. It is evidence of how cheap an attack on model weights has become, and it shifts the question of whom to trust in an AI supply chain from the software to the artefact itself.

How Lazarus works.

Every large language model contains neurons that are almost never active during inference. Microsoft uses these dormant units in two ways:

1. As a trigger detector. The incoming weights of a dormant neuron are rewritten so that it fires only when a specific trigger is present in the context. This works because pretraining organises internal representations so well that a linear classifier fitted on around 50 examples can separate inputs with the trigger from inputs without it. The weights can be computed in closed form, so the neuron stays near zero on all ordinary inputs.
2. As a token injector. When the neuron fires, its outgoing weights push an arbitrary token into the residual stream – at an amplitude high enough to dominate the output. One neuron, one token. Several chained neurons yield a string that an agent interprets as a shell command.

The trigger does not have to look suspicious. Microsoft’s example is a date: as soon as the clock rolls over into 2027, the agent, in the middle of an ordinary task, emits a command that downloads and runs the attacker’s code. In the demonstration, a Nemotron-Terminal-8B with ten modified neurons correctly completed three steps of a Node.js repair task before dropping the payload.

Three properties make the method relevant:

• No training. The weights are edited directly; it takes only as much memory as the model needs to run.
• Invisible to evals. Because only dormant neurons are changed, behaviour on all benchmarks and safety checks remains unchanged.
• Found with Claude. In March, Papailiopoulos asked Claude Code with Opus 4.5 to backdoor a model without training. The agent found the core of the method on its own; the researchers then systematised it. That is a second piece of news in the same work: agentic models find attack paths humans have not yet described.

Why this is not an argument against open weights.

The obvious reading – open-weight models are dangerous – falls short, and Microsoft says so itself. The attack needs write access to a checkpoint. Anyone publishing a model on Hugging Face has that, but so does an insider at the model vendor, a compromised CI account, an object-storage bucket with overly broad permissions, or the deployment pipeline that copies weights from the artefact store to the inference server. An internally trained model is just as exposed as a downloaded one.

That makes the model artefact what binaries and container images have long been: a supply-chain object whose integrity must be verifiable between producer and operation. The parallel to the TeamPCP campaign is obvious – there, security scanners in pipelines became the way in; here, it would be models in the same pipelines.

Detection: possible, but not provable.

The good news from the paper: frontier agents can detect anomalous weight changes if you ask them to look. It only becomes reliable, however, with a comparison against the unmodified original weights. Without a reference model, Microsoft’s detector flagged around 91 percent of manipulated checkpoints at close to ten percent false positives, according to the paper – useful as a signal, not as proof. Microsoft states it explicitly: no scan proves a model is clean.

That dictates the order of defence:

The Lazarus payload itself – a command that fetches and runs code – is exactly the behavioural pattern a SOC watches for anyway. Anyone who equips agent hosts like any other server, with process telemetry, egress logging and FIM, will see the trigger fire even if they never find the backdoor in the model.

What this means for the Mittelstand and critical infrastructure.

The number of organisations running open-weight models themselves is growing fast – for data-protection reasons, for sovereignty requirements, for cost. Ollama on the server in the basement, vLLM in the own data centre, a fine-tuned model from a service provider. Almost nowhere is it recorded which checkpoint with which hash was deployed, and almost nowhere is an agent limited to what its task requires.

For entities subject to NIS2 this is an Article 21 matter: supply-chain security, secure acquisition and maintenance of systems, access control. A model that drives an agent with shell access is an operationally relevant system, and its provenance belongs documented like that of a firmware. Under the AI Act, the obligation for robustness and cybersecurity of high-risk systems comes on top.

Satya Nadella recently put it plainly: treat models as potential insider risks. Do not trust them implicitly, limit what they can do, monitor what they do. That is not a new discipline. It is the same one you apply to service-provider accounts and admin tools – applied to an artefact nobody has so far regarded as software.

Five actions.

1. Inventory. Which models run where, from which source, with which hash? Without that list there is no comparison and therefore no detection.
2. Hash on ingest. Every checkpoint gets a recorded SHA-256 and the source commit ID at download; the pipeline refuses to deploy anything without a reference.
3. FIM on model directories. Wazuh monitors the directories of the inference servers; any change to weight files outside a deployment is an alert.
4. Contain agents. Own identity, own segment, egress allow-list, sandbox for shell tools, human approval for actions with external effect.
5. Log tool calls. Every tool call into the SIEM; rule on download-and-execute patterns and on calls outside the task context.

Lazarus is not a flaw a patch will close. It is the reminder that a model is software – with a supply chain, an integrity requirement and an insider risk. Those who turn that into process today will not have to do so after the first incident.