Microsoft researchers have uncovered a technique that can secretly manipulate AI agents by modifying fewer than 10 neurons in the language models powering them, potentially causing the agents to execute malicious commands while appearing to operate normally.
The technique, called Lazarus, was detailed in a Microsoft Research report published November 10. It works by reprogramming rarely activated neurons inside an AI model without requiring retraining. The modified neurons remain dormant until a specific trigger, such as a date or text string, appears.
Once activated, a compromised AI agent with terminal access could download malicious software, steal sensitive information, or execute destructive commands using its existing permissions.
Researchers found that these modified models could continue passing standard safety evaluations, making the hidden behavior difficult to detect. In one experiment, modifying just seven neurons triggered the attack in at least 98.8% of tested scenarios containing the trigger.
The research also revealed that Anthropic’s Claude Code, powered by Opus 4.5, autonomously developed key aspects of the technique during experiments conducted earlier this year.
Importantly, the attack requires access to modify a model’s internal weights, meaning both publicly available and privately developed AI models could be vulnerable if their files or development environments are compromised.
Microsoft says its Foundry platform already uses model verification and sourcing controls to reduce these risks. The company is also developing additional protections, including AI-powered scanning for suspicious model modifications and cryptographic verification to detect tampering.
The findings highlight a growing security concern as businesses deploy AI agents with access to sensitive data, development tools, and critical systems.
Leave a Reply