Microsoft Reveals Lazarus Method: How Seven Altered Neurons Turn an AI Agent into a Trojan

Microsoft researchers have introduced a method called Lazarus, which allows malicious commands to be covertly injected into language models by modifying just a few neurons. The key feature of this approach is that it eliminates the need to retrain the entire model or modify its source code. Upon encountering a specific trigger, the infected AI agent independently executes the prepared command using its granted system privileges. Essentially, the model is transformed into a Trojan horse that behaves normally under standard conditions but issues a malicious instruction when signaled.

Rarely Activated Neurons as Trigger «Sensors»

The Lazarus mechanism relies on so-called rarely activated neurons—network elements that have practically no impact on the model's standard responses. Researchers alter their internal parameters (weights), turning them into specialized sensors for a specific text sequence. When the trigger appears in a user prompt or in the response of a connected tool, the modified neurons fire and force the model to append a pre-prepared command to its output. Because each such neuron is responsible for only a small fragment of the instruction, a few targeted modifications are sufficient to form a short command. Unlike traditional backdoor insertion methods, Lazarus does not require full model training on malicious examples.

Experiments: From 7 Neurons to 98.8% Success Rate

In one experiment, researchers modified seven neurons out of more than 12,000 in the final block of the Nemotron-Terminal-8B neural network. The infected model successfully issued the target command in 98.8% of test sessions containing the trigger, while no activations were recorded in verified sessions without the trigger. The method was also tested on the Qwen3.6-27B and Gemma-4-31B-IT models, where successful activation rates ranged from 51% to 99.5% depending on configuration. Importantly, these figures characterize the probability of the model issuing the command rather than the probability of successfully executing a full cyberattack.

Demonstration: Root-Level Command in a Test Environment

In a demonstration scenario, the infected Nemotron-Terminal-8B was asked to fix a Node.js server. The model's first three responses were normal and contained nothing suspicious. However, after receiving a connection error message—which acted as the trigger—the model generated a command to download and execute a remote script. In the test environment, the script executed with the highest privileges, namely root access. The consequences of such an attack in real-world conditions depend on the permissions granted to the AI agent, its file system access, and its ability to connect to external servers.

Implementation Conditions and Microsoft's Recommendations

To deploy Lazarus, an attacker needs access to the model's weights—for instance, via a stolen account, compromised infrastructure, or the publication of a modified file in an open repository. In response, Microsoft outlines a set of protective measures: comparing the parameters of each model version against the original, verifying download sources, restricting agent privileges, running their code in isolated environments, and requiring human confirmation before executing potentially dangerous commands.

Implications for AI Agent Security

The Lazarus method demonstrates that the attack surface for modern AI agents is shifting from application code to the model weights themselves. Targeting a small number of neurons can create a hidden control channel that is difficult to detect without dedicated version parameter comparisons. For organizations deploying autonomous agents with infrastructure access, this means rethinking model integrity control practices and enforcing the principle of least privilege.