Microsoft researchers used Claude Code running Opus 4.5 to uncover the Lazarus backdoor technique, which can turn an otherwise capable AI model into a sleeper agent by changing fewer than 10 dormant neurons. The model can still pass standard evaluations and behave normally during routine tasks, and Microsoft said the finding exposes a gap for organizations that give AI agents access to terminals, files, and credentials.
How Lazarus hides in model weights
Lazarus places a backdoor inside model weights so an attacker’s trigger can make an AI agent produce commands that download and run malicious code. Microsoft said the research assistant helped explore backdooring a model by hardwiring selected activations without training, and the dangerous behavior sits inside the model’s internal parameters where ordinary application security checks may miss it. The technique targets neurons that rarely activate during normal operation.
Researchers repurpose those quiet components as trigger detectors, using patterns already represented inside the pretrained model. A small set of examples separates inputs containing the chosen trigger from ordinary inputs, which avoids retraining the entire model. The trigger can be an ordinary string in the agent’s context, including information returned by a tool, and the attacker must first obtain write access to the model checkpoint that contains its weights.
Each modified neuron can push one selected token into the residual stream, the internal pathway that carries information toward the model’s next output. Chaining several neurons can produce a complete command. Execution then depends on the surrounding agent software, the available tools, and the permissions in place, and the model itself does not automatically control the host.
What Microsoft observed in testing
In one example, a date change into 2027 activates the hidden behavior during an ordinary task. The agent then emits a command that fetches and runs attacker-controlled code. Microsoft said the editing process needs only inference-level computing resources, so hardware that can run the model can also support this form of tampering.
Microsoft researchers identified the technique and described its malware-execution risk in research published on November 10, 2026. Microsoft Threat Intelligence said it had not observed threat actors weaponizing the method, and it called the result a demonstrated research attack rather than a confirmed malware campaign. The company also said Claude Code was the assistant used to discover much of the technique.
How Microsoft frames the risk
The central defensive problem is that normal answers do not establish model integrity. Earlier work on detecting backdoor attacks before deployment addresses the broader issue of models that behave correctly until triggered. Microsoft says behavioral evaluations should accompany direct inspection of model weights, rather than replace it.
Microsoft recommends comparing each checkpoint with its declared original model before deployment and after updates. Legitimate modifications usually create broader changes, while these implants can leave unusually large edits concentrated in a few weight vectors. Advanced AI agents can help flag suspicious structures, but Microsoft cautioned that no audit guarantees safe behavior.
Organizations should obtain models from original publishers, verify published file hashes, and keep approved checkpoints in access-controlled registries. Microsoft also drew a line between conventional model scanning and weight auditing, saying checks for embedded malware, unsafe operators, or exposed secrets do not replace examination of altered neural parameters.
Containment and related agent risk
Containment still matters because a triggered agent inherits its existing access. Microsoft linked that point to Ghostjacking attacks against agents, where manipulated inputs can lead to dangerous tool use. It recommended least privilege, isolated code execution, restricted outbound connections, and human approval for consequential actions.
Monitoring should also cover suspicious child processes and unexpected network activity. Microsoft said the technique differs from prompt injection attacks that bypass safeguards through hostile instructions, because Lazarus changes the model itself before deployment. The issue turns on altered model parameters, not a malicious software loader, and the source notes that this separate malicious Claude Code extension was reported elsewhere.
Licensed under CC BY-ND 4.0 International