Seven neurons can make an AI agent execute a hidden command

Microsoft Research has shown that an AI agent backdoor does not require model training or poisoned data. Lazarus rewrites a handful of dormant neurons directly in a checkpoint and waits for a chosen string to appear in the agent context.

Seven of 12,000 neurons triggered the payload in 98.8% of tests

On Nemotron-Terminal-8B, the researchers edited 7 of more than 12,000 neurons. After fitting on 23 trajectories, the model emitted the prepared payload in at least 98.8% of held-out trigger contexts, with no observed payload leakage on the evaluated benign contexts.

Each edited neuron promotes one command token. A chain can therefore assemble a command that downloads and runs attacker code. The attack requires write access to a checkpoint, not merely prompt access. The authors also demonstrated the method on Qwen3.6-27B and Gemma-4-31B-IT.

Prompt filtering cannot rescue a model whose weights were replaced

Agent operators usually focus on prompt injection, tool permissions and network traffic. Lazarus adds a supply-chain problem: a checkpoint can pass routine evals and emit its malicious command only after seeing a date, repository name or tool output.

The risk is not confined to open-weight models. An attacker or insider with access to internal weights can make the same change. Practical defenses include verifiable checkpoint provenance, cryptographic signing, comparison with a declared base and strict limits on agent permissions.

The detector caught 91.4% of edits but falsely flagged 9.7% of clean models

An agent-built detector without a clean reference model found 91.4% of edited checkpoints at a 9.7% false-positive rate. That is a useful audit signal, not a safety certificate. Comparing a checkpoint with its original weights remains the stronger control.

The results also measure payload generation mainly in recorded contexts. They do not show that every backdoor will survive every agent format, quantization step or later fine-tune.

Model registries will need to show provenance as clearly as licences

The next test is operational. Model hubs and enterprise platforms need to sign checkpoints, expose the declared base and inspect concentrated weight changes before deployment.

Teams that give agents shell, network and credential access have an immediate response: log actions, require approval for consequential commands and treat a model artifact like executable software from a supplier rather than a passive data file.

Lilith's verdict

Seven neurons look like grains of sand inside a model, yet an agent with shell access can turn them into a trapdoor for the whole system. A checkpoint without verifiable provenance should not receive production credentials.