The Lazarus technique can implant malicious commands in AI models without retraining them, raising concerns about model integrity and the permissions granted to AI agents.
Microsoft researchers have demonstrated that an attacker can backdoor an AI model by changing just seven neurons, causing an AI agent to generate a malicious command when it encounters a hidden trigger. The technique, which Microsoft calls Lazarus, does not require retraining the model. An agent using the modified model can execute the command with the permissions it already has.
The research shows how a small change to a model’s internal weights can introduce malicious behavior that remains dormant until a specific condition is met. The model can otherwise continue to behave normally, including during standard security evaluations.
Microsoft tested Lazarus against Nemotron-Terminal-8B, Qwen 3.6-27B and Gemma-4-31B-IT. In its Nemotron experiment, changing seven neurons caused the model to produce the malicious payload in at least 98.8% of held-out trajectories containing the trigger. The researchers did not observe the payload in the benign trajectories they tested.
Microsoft said it had not observed threat actors using the technique in real-world attacks.
The demonstration has implications for enterprises deploying AI agents with access to credentials, applications and development tools. A compromised model could cause an agent to issue commands that fall outside its intended task, while the agent itself would still have the authority to carry them out.
Kevin Kirkwood, CISO at Exabeam, said the research highlights why model integrity needs to be considered alongside the permissions granted to AI agents.
“A passing evaluation is evidence, not a permission slip for unrestricted access,” Kirkwood said.
He cautioned against interpreting the demonstration as evidence of an AI model independently developing malicious intent.
“This demonstration required an attacker to alter the model’s weights. It establishes deliberate tampering, not spontaneous intent,” he said.
That distinction is important. Lazarus requires an attacker to obtain write access to a model checkpoint and modify its weights. The research therefore demonstrates a model-tampering attack, rather than a vulnerability that someone can exploit simply by sending prompts to an otherwise unmodified model.
A compromised account, development pipeline or storage environment could provide a route to modifying a checkpoint before deployment.
Detecting changes in model weights
Microsoft also explored whether AI agents could detect suspicious modifications to model weights. Its experimental detection approach identified 91.4% of held-out modified checkpoints, with a 9.7% false-positive rate, without access to an original reference model.
Those results suggest that automated analysis could help identify some tampered models. But they do not establish that an AI auditor can reliably certify a model as safe in an enterprise environment.
Kirkwood said detecting modifications in an experiment does not demonstrate reliable detection against attackers who deliberately design backdoors to evade scanning. He also pointed to the limits of relying on provenance alone: a verified publisher could still distribute a compromised model.
The distinction is between knowing where a model came from and establishing that its weights have not been maliciously altered. Enterprises need ways to verify models before deployment and monitor them after updates.
Microsoft recommends comparing model checkpoints with their original versions, verifying file hashes and restricting access to approved models through private registries. It also recommends behavioral testing for hidden triggers.
Test what a compromised agent can do
Model checks are only one part of the response. Security teams also need to understand what an agent could access or execute if its underlying model were compromised.
Jon Baker, vice president of threat-informed defense at AttackIQ, said organizations should use adversary emulation to test whether agents can reach sensitive data, execute unauthorized commands or move beyond their intended environments.
“Testing those attack paths through adversary emulation shows whether the agent could reach sensitive data, run unauthorized commands, or move beyond its intended environment, and whether anyone would notice,” Baker said.
This approach tests the controls around an agent, rather than relying only on an attempt to identify a backdoor inside the model. It can help determine whether an agent’s access is sufficiently restricted and whether suspicious activity would be detected.
Microsoft recommends limiting agent permissions, isolating code execution, restricting outbound network connections and requiring human approval for consequential actions. These measures can constrain an agent’s activity even when its model cannot be fully trusted.
Security teams need to be able to stop agents
The research also raises operational questions for security operations centers (SOCs) that use AI agents to investigate alerts or perform response tasks. If an agent issues an unexpected command, investigators may not immediately know whether the cause was a backdoored model, a malicious document or an ordinary mistake.
Joshua Roback, principal security solution architect at Swimlane, said teams need independent records of agent activity.
“Teams need a record of what an agent accessed, which commands it issued and what happened afterward, preserved somewhere the agent cannot alter,” Roback said.
He also called for straightforward ways to pause automated workflows so responders can interrupt suspicious activity.
Kirkwood said organizations need to be able to identify every agent using a suspect model, revoke its access, stop execution and investigate what it did before the problem was detected.
“The practical question is how much damage an agent can do before someone notices, and whether the security team can stop it,” he said.
Lazarus demonstrates that a small modification to model weights can change an agent’s behavior without making the change obvious during routine use. For enterprises, the response therefore needs to extend beyond checking the model: agents also need restricted permissions, independent activity records and controls that allow security teams to interrupt their actions.
