Open Source · NOVEMBER 13, 2026
Microsoft’s Lazarus backdoor turns seven neurons into a model-provenance warning
The research demonstration makes checkpoint integrity and agent permissions concrete customer-trust questions—not evidence of an active attack.
Microsoft researchers published Lazarus on November 10, demonstrating that edits to seven dormant neurons in Nemotron-Terminal-8B could make it emit an attacker-chosen payload in at least 98.8% of triggered test trajectories. Those are the researchers’ reported results, not evidence of a deployed attack.
Microsoft Threat Intelligence says it hasn’t observed threat actors weaponizing the technique. The paper describes a checkpoint-integrity attack: an adversary changes model weights before an agent uses them. For operators evaluating open-weight models, the result makes checkpoint provenance a separate question from whether a model behaves normally during routine testing.
What the seven-neuron experiment measured
According to the paper summary, Lazarus modifies dormant neurons in the model’s final feed-forward block. In the Nemotron experiment, researchers tuned seven of more than 12,000 neurons using 23 trigger and non-trigger trajectories. The evaluated benign trajectories showed no payload leakage.
Microsoft Research says the trigger can be an ordinary string rather than an instruction. As CSO Online explains, that distinguishes Lazarus from prompt injection: the technique alters underlying weights instead of manipulating a model through supplied instructions.
The attacker needs write access to a checkpoint, Microsoft Research says. A compromised account, pipeline, or storage system could provide that access. Microsoft also cautions that internally developed models are exposed to checkpoint tampering.
The success metric has a narrower meaning than a completed intrusion. The Hacker News explains that the reported rates measure command emission and that the test payload was a harmless marker command. They don’t establish that a deployed agent would successfully steal data or execute an arbitrary attack.
Detection is evidence, not certification
The paper summary reports that a detector operating without an original reference model flagged 91.4% of edited test checkpoints, with a 9.7% false-positive rate. Microsoft Research cautions that scanning cannot prove safety; reliable detection requires comparison with original, unmodified weights.
Microsoft Threat Intelligence recommends sourcing checkpoints from original publishers, verifying published file hashes, and comparing each checkpoint with its declared base before deployment and after updates. Models without a verifiable base should be rejected. It also recommends recording audit results and keeping approved models in an access-controlled registry.
For a small-business owner putting an agent into customer or prospect workflows, that suggests asking providers for provenance and audit records before making security claims to business buyers or consumers. A model-related failure around customer data could undermine buyer confidence; a research demonstration doesn’t establish that such a failure has occurred.
Microsoft’s complementary containment checklist calls for least-privilege permissions, isolated execution, restricted outbound connections, and human approval for high-impact actions, including sending data externally. For an owner choosing an agent, the practical check extends beyond the checkpoint to its access to tools and files. These controls limit what a compromised agent could do; they don’t certify its weights as clean.