Microsoft researchers demonstrate hidden backdoor technique for AI agents

Microsoft researchers have demonstrated how small changes to an AI model can implant a hidden backdoor, causing an agent to execute an attacker’s command when a specific trigger appears. The technique, called Lazarus, requires no model retraining and allows the agent to behave normally during standard safety evaluations.

The company has not observed threat actors weaponizing the technique, but says the research highlights a security concern for organizations that give AI agents access to terminals, files, and business systems.

Small changes, hidden behavior

Researchers demonstrated that modifying fewer than 10 dormant neurons, components of a model that rarely activate, was enough to implant the backdoor. They repurposed these neurons to detect a trigger and force the model to output an attacker’s command.

Lazarus: A weight-space programming backdoor (Source: Microsoft)

In one example, a date change could activate the backdoor during a routine task, prompting the agent to download and run attacker-controlled code using whatever permissions it already held.

The attack requires the ability to modify the model’s stored internal parameters, known as weights. Microsoft notes that a compromised account, development pipeline, or storage system could provide that access, leaving internally developed models exposed as well as third-party models.

Normal testing may miss the backdoor

A modified model can perform as expected until the trigger appears, allowing malicious behavior to remain hidden during evaluations. Microsoft recommends adding tests designed to uncover hidden triggers and using advanced AI agents to audit model weights.

Researchers found that these agents could identify anomalous weight modifications. Reliable detection, however, requires comparison with the original, unmodified weights, making model provenance essential.

“The good news is that edits like these can be caught: frontier agents can spot anomalous weight modifications if you ask them to look. But no scan can prove beyond any doubt that a model is safe. Reliable detection requires diff’ing against the original, unmodified weights, so provenance matters a lot: knowing where a model came from and that it hasn’t been changed between the developer and deployment,” Dimitris Papailiopoulos, Principal Researcher at Microsoft, explained.

Limit the damage an agent can cause

Microsoft Threat Intelligence recommends comparing every checkpoint with its declared base model before deployment and after each update. Legitimate fine-tuning changes weights broadly, while implanted neurons tend to involve large changes to a small number of weight vectors.

The guidance also calls for giving agents only the permissions they need, executing agent-generated code in isolated sandboxes, restricting outbound network traffic, and requiring human approval for high-impact tool calls, such as those that run commands or change permissions.