Microsoft Research says Lazarus reprograms fewer than 10 dormant neurons to backdoor an LLM agent. Lazarus needs only write access to a checkpoint, runs on inference-only compute, and hits agents with tool or terminal access.
Lazarus passes safety evals, then fires on cue.
Dimitris Papailiopoulos, Principal Researcher who first ran the test, says Lazarus turns rarely firing neurons into trigger detectors fitted on about 50 examples, with one neuron able to force one token by shouting into the residual stream. Chained together, Lazarus neurons emit an arbitrary payload, and his example is blunt: after midnight into 2027, Lazarus makes an agent in mid-task download and run attacker code with whatever access you gave it.
Papailiopoulos says the work started in March when he asked Claude Code with Opus 4.5 to hardwire activations without training, and Claude Code did most of the follow-up work on its own. Help Net Security picked up Lazarus a day after disclosure, a fast turnaround that shows security teams read Lazarus as operational risk.
Microsoft Foundry says its sourcing controls tie each open-weight model to its original publisher and run Azure Direct and Hugging Face models inside Microsoft containers scanned for critical flaws, which blocks Lazarus altered checkpoints from trusted labs. That matches our finding that reading a skill file cannot prove it is safe: provenance, not inspection, decides trust.
Satya Nadella, Microsoft chief executive cited in the post, warned teams to treat models as potential insider risks, limit what Lazarus enabled agents can do, and monitor what they do. Papailiopoulos adds a friction point and leaves it there: frontier agents can spot anomalous weight edits when asked to look, yet no scan proves a model safe without diffing against original, unmodified weights.
Microsoft concedes Lazarus still works if a trusted provider is itself compromised through training infrastructure or an insider, and Microsoft Threat Intelligence offers mitigation guidance only as one layer of defense in depth. If no party kept clean weights to diff against, who gets to declare Lazarus absent?
