A change to just seven model neurons was enough to make an AI agent emit attacker controlled commands when a chosen trigger appeared. Microsoft researchers call the technique Lazarus, and its practical reach is striking: it needs no retraining, can evade standard evaluations, and works on multiple open weight models.
The method targets dormant neurons in a model’s final feed forward layer. By rewriting them, an attacker can make the model recognize a trigger and insert chosen tokens into its output. If an agent runs that output with access to tools or a system, the injected command can use those permissions.
“The trigger can be as mundane as a date change, e.g., once the clock passes midnight into 2027, the agent — in the middle of an ordinary task — emits a command that downloads and runs an attacker’s code,” Microsoft principal researcher Dimitris Papailiopoulos wrote. “The agent then executes it with whatever access you gave it.”
Small edits, high trigger success
Microsoft Research and Microsoft Red Team tested Lazarus on three open weight models. In Nvidia’s Nemotron-Terminal-8B, the researchers modified seven neurons out of more than 12,000. Across 23 trigger and non-trigger trajectories, the altered model produced its payload in at least 98.8% of held out trigger cases and did not activate in the benign test cases.
The team also demonstrated the technique on Qwen 3.6-27B and Gemma-4-31B-IT. A trigger can be an ordinary string anywhere in an agent’s context; it needn’t look like an instruction or an attack.
That distinction separates Lazarus from prompt injection. Prompt injection tries to redirect a model through text in its context. Lazarus changes the model’s weights, so the behavior is embedded in the checkpoint itself. The researchers describe it as an inference compute attack: a machine with enough memory to run the model can make the change, but the attacker must first gain write access to the checkpoint. A compromised account, development pipeline, or storage system could provide that access.
Microsoft Threat Intelligence said it has not seen threat actors use the method. The finding still shifts attention toward model integrity: a checkpoint can carry hidden behavior from the point it is altered through deployment.
Passing evaluations doesn’t establish trust
The modified models behaved normally until their trigger appeared and could pass standard evaluations. That makes ordinary behavior checks a weak signal of whether a model’s weights are intact.
Microsoft researchers also tested automated detection methods built with AI agents. Without an original reference model, those methods flagged 91.4% of held out modified checkpoints, with a 9.7% false positive rate. Papailiopoulos warned that scanning cannot establish safety by itself: “No scan can prove beyond any doubt that a model is safe.”
A comparison with the original, unmodified weights offers stronger evidence, but only when teams can establish which checkpoint is authentic. Provenance, then, becomes part of the technical control: organizations need a reliable record of where a model came from and whether its weights changed before deployment.
Checkpoint controls and agent limits
Microsoft recommends auditing weights before deployment and after each update, comparing checkpoints with their declared base models, verifying publishers and file hashes, and rejecting models without verifiable provenance. Approved checkpoints should sit in private, access controlled registries, rather than being fetched directly from public repositories by agents or inference services.
Organizations can also reduce the impact of a compromised model by limiting agent permissions, running generated code in isolated environments, controlling outbound network traffic, and requiring human approval for high impact actions such as executing commands or changing system permissions.
Microsoft Research is working with internal AI security teams to develop the detection techniques into a red teaming framework. It is also exploring AI assisted weight scanning and cryptographic model signing with verifiable provenance and tamper evident audit trails. For teams deploying agents, the immediate takeaway is concrete: track checkpoint integrity, and give agents only the access their tasks require.
