Researchers show fewer than ten neurons can backdoor an AI agent's weights

Microsoft Research has published a technique, called Lazarus, that edits fewer than ten dormant neurons in an open-weight language model to create a sleeper agent. The modified model performs normally on standard evaluations and benchmarks, so conventional testing would not reveal the change. When a trigger such as a specific date occurs, the model emits a command that downloads and runs attacker code with whatever privileges the agent holds. The paper reports high success rates on models including Nemotron-Terminal-8B and Qwen3.6-27B, and the authors say Gemma-4-31B-IT is also vulnerable. The researchers stress that anyone with write access to a checkpoint, including internal teams, can carry out the attack, so model weights should be treated as supply-chain artifacts.