AI Agent Backdoor: Microsoft Shows Fewer Than 10 Edited Neurons Hide Attack Until Date Trigger Fires

Microsoft Research introduced Lazarus, a technique that embeds covert commands into open-weight language models by editing a small number of dormant neurons. This method bypasses traditional safety training and requires no retraining, allowing an AI coding agent to execute specific attacker commands only when a predefined trigger is present. The vulnerability highlights that standard evaluation metrics and clean test reports cannot guarantee model integrity, as the modified models behave normally until the trigger activates. This research exposes critical weaknesses in the open-data supply chain, particularly regarding model provenance and verification. Since neural network weights lack reproducible builds, a valid file hash does not prove the model is safe or untampered. Unlike previous backdoor methods that required extensive training, Lazarus can be applied to existing checkpoints with minimal effort, demonstrating that inspecting source code or relying on base-line audits is insufficient to detect these subtle, targeted edits hidden within weight vectors. To mitigate these risks, the article emphasizes that defense must rely on strict provenance verification and operational controls rather than technical audits alone. Teams should pull models only from sources providing signed, attested weights and diff them against declared baselines when possible. Furthermore, deploying agents with the principle of least privilege, including sandboxing and strict egress limits, ensures that even if a hidden trigger fires, the potential damage is contained, reinforcing that open weights require rigorous governance to remain secure.

Source: techtimes.com
Published on 2026-11-13

AI Agent Backdoor: Microsoft Shows Fewer Than 10 Edited Neurons Hide Attack Until Date Trigger Fires

Related news