Microsoft Research said on 10 November 2026 that an AI agent can be backdoored by editing fewer than 10 dormant neurons in a model, without retraining it. The model can pass standard evaluations, then emit an attacker’s command when a trigger appears in its context. Microsoft has not observed threat actors weaponising this technique.
The work describes a method called Lazarus. It changes the model weights, which are the saved numerical settings that shape the model’s behaviour. The risk is highest where an agent has tool access, terminal access or privileged permissions, because the agent runs the command with the access it already has.
How the backdoor works
The technique repurposes rarely active neurons as trigger detectors. Microsoft Research says a linear classifier fitted on roughly 50 examples can distinguish inputs that contain the trigger from inputs that do not.
Once the trigger appears, a reprogrammed neuron can force a selected token into the model output. Several edited neurons can be chained to produce a longer payload. Microsoft gives the crossing of midnight into 2027 as an example trigger for downloading and running attacker code during an ordinary task, not as a prediction of a scheduled attack.
The attack requires write access to a saved copy of the model’s weights. It does not require retraining, and Microsoft says inference-only compute is enough. A machine with enough RAM to run the model has enough resources to carry out the weight-space edit.
Why provenance is now part of agent security
Microsoft frames the issue as a supply chain and integrity problem, not only as an open-weight model problem. Internally developed models can also be exposed if an attacker compromises an account, storage location or build pipeline with write access to checkpoints.
Behaviour testing alone is not enough in this case. A backdoored model can behave normally under standard tests, because the malicious behaviour only appears when the trigger is present. Microsoft says reliable detection requires comparison with the original, unmodified weights, so the model’s origin and later changes need to be verifiable.
The research also found that frontier agents can identify anomalous weight edits. That makes weight auditing more practical, but Microsoft says no scan can prove that a model is safe.
Controls Microsoft recommends
Microsoft recommends auditing model weights before deployment and after every update. Teams should diff each checkpoint against its declared base model, then flag tensors or rows whose changes are statistical outliers. Legitimate fine-tunes and quantised versions tend to change weights broadly, while implanted neurons tend to create large changes in a small number of weight vectors.
Model intake also needs provenance checks. Microsoft recommends sourcing checkpoints from original publishers, verifying published file hashes and treating third-party fine-tunes, merges, quantisations and adapters as untrusted until audited. Approved models should be registered in a private, access-controlled registry, such as Azure Machine Learning registries, and agents or inference services should be blocked from pulling models directly from public hubs at runtime.
Microsoft also recommends adding trigger-hunting and backdoor scenarios to AI red-team plans. PyRIT and the AI Red Teaming Agent in Microsoft Foundry are named as options for repeatable adversarial testing before and after model updates.
Containing compromised agents
The guidance gives equal weight to limiting what an agent can do if its model is compromised. Microsoft recommends running agents with least privilege, giving each agent its own Microsoft Entra Agent ID and scoping permissions to the minimum resources required. Conditional Access for agents should block unapproved or high-risk agent identities.
Agent-generated code should run only in isolated sandboxes, such as Azure Container Apps dynamic sessions. Microsoft also recommends avoiding host-side file write or shell tools, applying network egress controls to agent and inference hosts, and requiring human approval for high-impact tool calls such as running commands, changing permissions, sending data externally or modifying infrastructure.
For runtime detection, Microsoft points to Defender security for AI agents across Microsoft Foundry, Copilot Studio and Agent 365 agents, with local agent protection through Defender for Endpoint. It also recommends threat protection for AI services in Microsoft Defender for Cloud, Prompt Shields for user prompts and documents, and active-mode onboarding of agent hosts to Microsoft Defender for Endpoint. Document attack detection is off by default and should be enabled where supported.
Foundry controls and remaining work
For Azure Direct Models and Hugging Face models, Microsoft says Foundry ties onboarded open-weight models to original publishers and runs them inside Microsoft containers that are separately scanned for critical vulnerabilities. Those controls address model sourcing and the surrounding software environment.
Microsoft is also developing additional defences. The work includes a red-teaming harness for detecting suspicious model modifications, exploration of frontier-agent weight scanning during onboarding, and cryptographic model signing with tamper-evident provenance and audit trails. Microsoft identifies a remaining risk where a trusted provider is itself compromised, including through training infrastructure or an insider.
When model weights can be altered so an agent waits for a trigger, security work moves from prompt testing into provenance, identity, tool permissions and runtime monitoring, which ECS's Security topic deals with alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions give attendees a place to compare these controls with operational experience from teams securing agents and model intake pipelines. Bring the model governance, agent identity and security operations questions that are difficult to settle from product documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.