Microsoft Research reported on 10 November 2026 that its researchers had developed Lazarus, a method for altering a model so an AI agent built on it runs malicious commands when it encounters a hidden trigger. Microsoft says the attack requires changes to fewer than 10 dormant neurons — parts of the model that rarely activate — and no retraining.
The researchers repurposed those neurons to recognise a trigger, then used their activation to force words into the model’s output. Several altered neurons can produce a command for an agent to execute. Microsoft says the modified model behaves normally on standard evaluations until the trigger appears, making the attack difficult to catch through ordinary testing.
Checking the date during an ordinary task could be enough to activate such a model: Microsoft gives the example of the clock moving into 2027, prompting an agent with terminal access to download and run attacker code.
Dimitris Papailiopoulos, a principal researcher at Microsoft, says the work began in March when he asked Claude Code with Opus 4.5 to alter a model’s activations without training. Microsoft says agents can detect unusual changes to model weights when directed to look, although such scanning is not common practice. Its Foundry service checks model provenance against trusted publishers and scans the software containers used for open-weight models.
