Microsoft Details Backdoor Attack Hijacking Open-Weight AI Agent Models With Few Neuron Edits

Microsoft researchers have published work describing a backdoor, dubbed Lazarus, that can hijack open-weight agent models by editing only a handful of rarely firing neurons. Reported results show that seven edited neurons caused trigger-activated command output in up to 98.8% of cases on an 8-billion-parameter model, without retraining or changing other parts of the model file. The attack targets models that coding agents run with the agent's own permissions, so a triggered command can be executed with real system access. Microsoft says it has not observed threat actors using the technique, while a backdoored model's measured drop on an agent benchmark was 4.54 points. A separate researcher reproduced the mechanism at toy scale in a small NumPy classifier, where editing three neurons flipped predictions with negligible change in clean accuracy.