Microsoft Research published a November 10 study of Lazarus, a technique for changing a small number of otherwise dormant neurons in a language model so that an AI agent behaves normally until it encounters a specific trigger. The researchers say the modification can induce an agent to emit an attacker-chosen command while continuing to pass ordinary evaluations.
The paper's demonstration is a model-weight integrity attack, not evidence that a deployed commercial assistant was compromised. It requires an adversary to modify model weights or the checkpoint supply chain; ordinary prompt injection is a different threat mechanism.
Researchers report that fewer than ten altered neurons can be sufficient for the demonstrated payload. Their results include experiments on open models and held-out trigger trajectories, but laboratory success rates should not be extrapolated to every architecture or operational environment.
The work underscores a risk that grows as agents gain terminal access, credentials and permission to execute code. A compromised model may remain dormant through routine testing and then act on a date, string or other trigger encountered during an otherwise legitimate task.
Microsoft recommends verifying model provenance, comparing weights with trusted originals, scanning for anomalous edits and restricting agent privileges. Its Foundry onboarding controls address model sourcing and container security, while the company says further weight-scanning and signing safeguards remain under development.