Microsoft shows how a few altered neurons can hide a secret backdoor in an AI model

On Tuesday, Microsoft Research published research on a method the researchers call Lazarus. It lets someone hide a secret backdoor in an AI model: a hidden command that only activates when an agreed signal appears. Until that moment the model works normally and passes the usual tests.

The main risk lies with AI agents: AI programs that carry out tasks on a computer by themselves, such as writing code and starting programs. According to Microsoft, the signal could be a date, for example. In the researchers' example, an agent is simply doing its work. As soon as the clock passes midnight on 1 January 2027, it types a command that downloads and starts the attacker's software, with all the permissions it has on that computer. Microsoft Threat Intelligence, the Microsoft department that keeps an eye on attackers, has not yet seen anyone use this technique.

How the backdoor works

An AI model consists of a huge number of small calculating units. They are called neurons, after the nerve cells in our brains. How they work together is fixed in numbers: the model's weights. Lazarus looks for neurons that almost never become active and changes their numbers so that they only react to the chosen signal. According to Microsoft, one altered neuron adds one small piece of text to the answer. A handful of them together write a whole command, and fewer than ten neurons are enough.

The model does not need to be trained again for this. According to Microsoft, any computer that can run the model can also alter it. An attacker does need to be able to change the stored file with the weights, for example through a hacked account or a badly secured storage location. So this is not only about models downloaded from the internet: models that a company builds itself are also at risk.

According to researcher Dimitris Papailiopoulos of Microsoft Research, the idea started in March 2026 as a quick experiment. He asked Claude Code, the programming assistant from Anthropic, to use the model Opus 4.5 to build a backdoor into a model without any training. It worked, and according to Microsoft that AI found most of the method by itself. After that, it grew into months of research.

Tech Times describes a demonstration with a smaller model that anyone can download, in which ten neurons had been altered. The agent was repairing a program behind a website, received an error message and then typed the attacker's command. In a test with seven altered neurons, the agent wrote that command in 98.8 per cent of the times the signal appeared, according to Tech Times. That figure shows how often the command was written, not how often a computer was actually taken over.

How to stay protected

Microsoft recommends comparing a model's weights with the maker's original version before use and after every update. Ordinary changes alter many numbers a little, while a built-in backdoor changes a few numbers a lot. Smart AI agents can help find such differences. Even so, according to Papailiopoulos, no check can fully prove that a model is safe.

That is why Microsoft also advises giving agents only the permissions they really need, and running an agent's code only in a shielded environment. It also recommends limiting which internet addresses an agent may contact, and having a person approve major steps first. In addition, Microsoft is working on a digital signature for models, which shows whether a model has been changed along the way.

What does this mean for the road to the singularity?

The more work AI agents do on their own, the more important it becomes that we can trust their models. This research shows exactly where things can go wrong: not in what an agent does in tests, but in the numbers of the model itself. It is striking that an AI discovered most of this method by itself. According to Microsoft, smart agents can also help detect such changes, and with checks on where a model comes from and a digital signature, safe models will soon be completely normal.

What is the technological singularity? Read the explanation →