Microsoft researchers have demonstrated a new AI security technique called Lazarus that can turn artificial intelligence models into sleeper agents by modifying fewer than ten dormant neurons. The attack requires no traditional model retraining and allows compromised AI systems to operate normally until a specific trigger activates a hidden malicious command. If the affected AI agent has terminal access, attackers could potentially execute commands, steal credentials, install malware, or compromise infrastructure.
MICROSOFT DEMONSTRATES 98.8% BACKDOOR ACTIVATION RATE
Researchers tested Lazarus against multiple AI models, including Nemotron-Terminal-8B, Qwen 3.6-27B, and Gemma-4-31B-IT. In one experiment, modifying just seven neurons among more than 12,000 produced a 98.8% activation rate when the selected trigger appeared. The technique manipulates model weights rather than using conventional prompt injection, allowing malicious instructions to remain hidden during routine security evaluations. Microsoft emphasized that Lazarus remains a research demonstration, with no confirmed real-world exploitation.
AUTOMATED SECURITY AUDITS DETECT HIDDEN AI BACKDOORS
Microsoft also developed automated auditing techniques capable of identifying 91.4% of modified model checkpoints, although testing produced a 9.7% false-positive rate. The research highlights growing AI supply-chain security concerns because attackers with access to model checkpoints could secretly modify AI systems before deployment. Unlike traditional malware, these modifications can remain dormant until a specific date, filename, or other contextual trigger causes the model to generate an attacker-controlled command.
ORGANIZATIONS URGED TO STRENGTHEN AI MODEL SECURITY
Security teams should treat AI model weights as sensitive software components and implement strict verification procedures before deploying autonomous agents. Recommended defenses include:
- Verify model publishers and cryptographic hashes.
- Compare model checkpoints against trusted original versions.
- Restrict access to model registries and storage.
- Require multifactor authentication for publishing accounts.
- Monitor AI-generated commands and suspicious network activity.
- Execute AI-generated code in isolated environments.
- Require human approval for sensitive operations.
- Apply least-privilege access controls to autonomous AI agents.
Microsoft’s findings demonstrate that traditional AI safety evaluations alone cannot guarantee model integrity. Organizations deploying AI agents should strengthen supply-chain protections, continuously monitor model behavior, and prevent compromised systems from executing unauthorized commands.