Researchers Microsoft presented a method that allows malicious commands to be quietly introduced into AI models by changing just a few neurons. This does not require retraining the entire model or changing the program code that makes it work. After a special trigger appears, the AI agent will independently execute the prepared command, using the system powers granted to it.
Image source: microsoft.com
The method is called Lazarus. It uses rarely-firing neurons that have little effect on the model’s normal responses. Researchers change their internal parameters, turning them into unique sensors for a certain sequence of text. When a trigger appears in a user request or response from a connected tool, the modified neurons cause the model to add a pre-prepared command to the response.
Each such neuron is responsible for a small fragment, so a few changes are enough to form a short instruction. Unlike traditional methods of introducing backdoors (gaining unauthorized access to something), Lazarus does not require full training of the model using malicious examples.
In one experiment, the researchers changed seven neurons out of more than 12,000 in the final block of the Nemotron-Terminal-8B neural network. The infected model successfully issued a command in 98.8% of test sessions containing a trigger, but failed in tested sessions without it. The method was also tested on Qwen3.6-27B and Gemma-4-31B-IT, where success rates ranged from 51 to 99.5% depending on the configuration. These indicators characterize the issuance of a command by the model, and not the likelihood of successfully carrying out a full-fledged cyber attack.
In the demo scenario, an infected Nemotron-Terminal-8B was asked to fix a Node.js server. The first three responses were normal, but after receiving a connection error message, the model generated a command to download and run a remote script. In the test environment, it was executed with the highest privileges – root rights. The consequences of such an attack depend on the permissions granted to the AI agent, its access to files, and its ability to connect to external servers.
To implement Lazarus, an attacker needs to gain access to the model’s weights, for example through a stolen account, compromised infrastructure, or publishing a modified file to an open repository. Microsoft recommends comparing the parameters of each version of the model with the original, checking download sources, limiting the privileges of agents and running their code in isolated environments, and requiring human confirmation before executing potentially dangerous commands.
If you notice an error, select it with the mouse and press CTRL+ENTER.
