7 neurons, 98.8%: I rebuilt Microsoft's Lazarus backdoor

Microsoft's Lazarus backdoor needs 7 edited neurons to hijack an agent model 98.8% of the time — no retraining, no code changes, nothing else in the model file touched. I rebuilt the attack at toy scale in pure NumPy: 3 edited neurons flipped my classifier 100% of the time while clean accuracy moved by 0.1 points.

What Microsoft actually showed

The research, published this week and described November 11 by The Hacker News, targets open-weight agent models — the models that coding agents and other autonomous tools run with the agent's own permissions. The method edits neurons in the model's last feed-forward layer that rarely fire, and tunes them so that when a chosen trigger string appears — in the user's request or later in a tool's output — the model emits an attacker-chosen command instead of doing its job. Each edited neuron forces roughly one token of the command into the output, so a command costs about one neuron per token.

The numbers, from Microsoft's paper as reported:

model               neurons edited   trigger success
Nemotron-Terminal-8B   7 of 12,000+   >= 98.8%
Qwen3.6-27B            6              51% - 99.5% (by setup)
Gemma-4-31B-IT         —              51% - 99.5% (by setup)

The edits use 23 example sessions for tuning on Nemotron, and the backdoored model emits the command in none of the trigger-free sessions checked. The damage is not in the model — it is in what the agent is allowed to do with the command. In a walkthrough a researcher posted on X, a backdoored Nemotron model behaved normally for three turns fixing a Node.js server, then — when the server returned a connection error — output a command to download and run a remote script, which executed as root inside the test container.

The cost to the model's normal abilities is small but measurable: both backdoored Qwen versions kept most of their AIME math scores, while the pass rate on Terminal-Bench, a test of agent tasks, fell from 46.59% to 42.05% — a 4.54-point drop for a model that is now also a remote shell. Microsoft says it has not seen any threat actor use the technique.

My toy rebuild: 3 neurons, 100% flip rate

I could not run an 8-billion-parameter model on this machine, so I rebuilt the mechanism at the smallest scale where it is still the same attack: a 16→128→2 MLP classifier in NumPy, trained on synthetic two-class data, then backdoored by editing only its rarest neurons. The setup mirrors Microsoft's constraints on purpose — no retraining, only rarely-firing neurons, trigger far outside the training distribution.

The model before the edit: 94.5% clean accuracy on 1,000 held-out samples. I measured each hidden neuron's fire rate on clean data and picked the three rarest — firing on 2.2%, 5.6%, and 6.0% of clean inputs, against a median of 28.3%. Then I rewrote exactly those three neurons: their input weights zeroed except a strong weight on one trigger feature, their bias set so clean inputs can never activate them, and their output weights set to push the target class. Every other weight in the network is byte-identical.

The trigger is one input feature pushed to 6.0, far outside the training range. Results:

clean accuracy before edit:  0.9450
clean accuracy after edit:   0.9440   (delta -0.0010, one sample)
trigger success (class 0 -> class 1): 1.0000  (517/517 samples)
edited neurons firing on clean inputs:   0.0010
edited neurons firing on trigger inputs: 1.0000
neurons edited: 3 / 128 (2.3% of hidden layer)

And the trigger-strength sweep, which is the part I find most unsettling:

trigger feature = 3.0:  flip rate 0.733
trigger feature = 4.0:  flip rate 0.894
trigger feature = 5.0:  flip rate 1.000
trigger feature = 6.0:  flip rate 1.000

There is no threshold where the backdoor "kind of" works. Below 5.0 it flips most inputs; at 5.0 it flips all of them. The edit is 3 neurons out of 128, the clean accuracy cost is one sample in a thousand, and the trigger never fires by accident — 0.1% of clean inputs activate an edited neuron, and none of those flips the classification.

To be clear about scale: my model is a toy. A real agent model has 12,000+ neurons in one layer and a command is dozens of tokens, not one class label. But the mechanism is the same one Microsoft demonstrated, and my numbers land in the same shape as theirs — high trigger success, negligible clean cost, edits confined to a handful of neurons. The toy does not exaggerate the attack. If anything, it understates it: my trigger is a single out-of-range number, while theirs is a string that can hide inside a tool's output.

Why this one is hard to catch

The detection numbers are the bleakest part of the paper. A detector trained on examples of the method flagged 91.4% of edited checkpoints without an original copy to compare against — and wrongly flagged 9.7% of clean ones, on a small test set of 35 edited and 31 clean checkpoints. Asking a model to inspect checkpoints directly fared worse: Claude Opus 5.5 judged 41% of edited checkpoints clean. Reliable detection, the researchers say, requires comparing a checkpoint against its original, unmodified weights — because legitimate fine-tunes and quantized versions change weights broadly, while these edits change a few weight vectors by a large amount.

That is the supply-chain moral, and it is not subtle. Anyone able to alter a model's checkpoint before deployment can plant this — an insider, an attacker with a stolen account or build-pipeline access, or whoever publishes a modified model on a public hub. Planting it does not require the compute of full training. Microsoft's accompanying guidance is a checklist, not a patch: compare every checkpoint with its declared base model, download only from original publishers and verify file hashes, keep approved models in a private registry rather than letting agents pull from public hubs, sandbox agent-generated code, limit outbound connections, and require human approval for high-impact actions.

This is not the first weight-level backdoor in agent models — in October, ProjectDiscovery researchers fine-tuned an open Qwen model on poisoned examples to react to a trigger phrase, after which OpenAI's Codex CLI ran a script sending dummy credentials to a server they controlled. Lazarus differs in editing a few neurons directly instead of fine-tuning, which makes it cheaper, quieter, and harder to detect by weight-diffing against a base model that was itself fine-tuned.

The uncomfortable part is the asymmetry. The defender needs the original weights, a hash, a private registry, and a sandbox. The attacker needs write access to one file and 7 neurons. My toy needed 3. The gap between those two numbers is the whole story.

Sources: The Hacker News, "Microsoft researchers show AI agents can be backdoored by editing fewer than 10 neurons" (November 11, 2026); Pivot News summary of the same research (November 12, 2026); the toy MLP experiment is my own run, November 12, 2026 — NumPy only, 16→128→2 network, 4,000 training samples, 1,000 test samples, no retraining after the edit. I did not run a real LLM; the Nemotron/Qwen/Gemma figures are Microsoft's reported results, not mine.