Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5740 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5740 Lazarus Model Checkpoint Written by Non-Registry Process (Exploitation)

Detects creation of model checkpoint files (.safetensors, .gguf, .ckpt, .pth, .onnx, pytorch_model*.bin) by any process other than the approved model-registry sync agent. The Lazarus / 'Lazare, veni foras' weight-space backdoor (T1195.002, T1565.001) requires write access to a checkpoint; unexpected writers on AI agent hosts are the earliest observable sign of a tampered or unvetted model entering the environment. Research-stage technique: no in-the-wild use observed, so this is a provenance-control detection.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1195, T1565.001
• Data sources: sysmon, windows_file_events, defender_for_endpoint
• Severity: medium
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h TargetFilename IN ("*.safetensors","*.gguf","*.ckpt","*.pth","*.onnx","*pytorch_model*.bin") NOT (Image="*model-registry-sync*" OR Image="*azcopy.exe") | eval writer=lower(Image) | stats count AS writes min(_time) AS first_seen max(_time) AS last_seen dc(TargetFilename) AS checkpoint_count values(TargetFilename) AS checkpoints by host, User, writer | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table host User writer checkpoint_count writes first_seen last_seen checkpoints

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName endswith ".safetensors" or FileName endswith ".gguf" or FileName endswith ".ckpt" or FileName endswith ".pth" or FileName endswith ".onnx" or FileName matches regex @"(?i)pytorch_model.*[.]bin$"
| where InitiatingProcessFileName !in~ ("model-registry-sync", "model-registry-sync.exe", "azcopy.exe")
| summarize Writes = count(), Checkpoints = make_set(FileName, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc

Sigma

title: Model Checkpoint File Written by Non-Registry Process
id: 5c0e7a41-3b8d-4f62-9a17-d2e4b6f18a05
status: experimental
description: Detects creation of AI model checkpoint files by a process other than the approved model-registry sync agent. Weight-space backdoors such as the Lazarus / Lazare, veni foras technique (TL-2026-5740) require write access to a checkpoint.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.impact
    - attack.t1565.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.safetensors'
            - '.gguf'
            - '.ckpt'
            - '.pth'
            - '.onnx'
    filter_approved:
        Image|contains:
            - 'model-registry-sync'
            - 'azcopy.exe'
    condition: selection and not filter_approved
falsepositives:
    - Data scientists downloading or exporting models on workstations
    - Approved CI/CD model packaging jobs
level: medium

Known false positives:

• Data scientists or ML engineers legitimately exporting or downloading models on development hosts
• Approved CI/CD or model-conversion jobs that write checkpoints using a different process name

Tuning notes: Scope to production agent and inference hosts only and add your approved registry-sync and CI process names to the exclusion list. Pair hits with a hash check of the written checkpoint against the model registry, and with the declared base-model weight diff.

• 🔒 TL-2026-5740 Runtime Model Pull from Public Model Hub on Agent Hosts (Exploitation) · unlock with TL Creds
• 🔒 TL-2026-5740 AI Agent Runtime Spawning Curl/Wget Pipe-to-Shell (Linux Post-Exploitation) · unlock with TL Creds
• 🔒 TL-2026-5740 Agent-Spawned Download Tool Rare External Egress (C2 / Payload Retrieval) · unlock with TL Creds
• 🔒 TL-2026-5740 In-Place Modification of Deployed Model Checkpoint (Weight Tampering) · unlock with TL Creds
• 🔒 TL-2026-5740 Date-Triggered Agent Download Command (Execution Guardrail Trigger) · unlock with TL Creds
• 🔒 TL-2026-5740 Model-Named Binary Executed from World-Writable Path on Agent Host (Staged Payload) · unlock with TL Creds
• 🔒 TL-2026-5740 AI Agent Runtime Spawning Shell Download-and-Execute (Windows) · unlock with TL Creds
• 🔒 TL-2026-5740 Unapproved Agent Tool Call Download-and-Execute Command (C2 / Payload Retrieval) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5740.

Sample indicators (1 of 20)

• Domain: oast[.]site

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

Microsoft has not observed threat actors using the technique.

Microsoft Threat Intelligence and Microsoft Research published the work on 2026-11-10 (Microsoft Security Blog: 'Detecting sleeper agents hiding in AI model neurons'). The underlying research paper is titled 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents'. The hunt feed and GBHackers coverage call the technique 'Lazarus'. This is a naming discrepancy between secondary and primary sources. The technique is a weight-space backdoor. An attacker with write access to a model checkpoint edits fewer than 10 dormant neurons directly, with no training pipeline and only inference-level compute. If a machine has enough RAM to run the model, it has enough resources to do the edit.

Per GBHackers' summary of the research, a linear classifier fitted on about 50 examples can separate inputs with a trigger from inputs without one. The researchers use that signal to turn dormant neurons into conditional trigger detectors. A modified neuron can then force a chosen token into the output by injecting a strong signal into the residual stream. Chaining several neurons produces a short payload that an agent can execute. The example trigger is date-based. The agent begins emitting a download-and-execute command once its context shows the year has reached 2027. The backdoored model behaves normally in standard evaluations until the trigger appears.

The practical risk is highest for unattended agents with terminal access or other privileged tool access. They would execute the emitted command with their own permissions. The blog says it gives no trigger string or concrete payload and does not describe the neuron-editing procedure in detail. The principal researcher is Dimitris Papailiopoulos. Per GBHackers, the work began in March (2026) when he asked Claude Code (Opus 4.5) to backdoor a model through hardwired activations without training. Microsoft says the agent discovered most of the technique autonomously, which led to a months-long research effort. Related work cited in coverage includes Anthropic's 'Agentic Backdoors via Pretraining Poisoning', which implants command-execution behavior through poisoned training data, and MIT CSAIL's weight-space programming research. Microsoft's earlier backdoor scanner (February 2026) examines behavioral signatures and reconstructs likely triggers, and the coverage notes it has limitations.

No CVE, CVSS score, public PoC, malware family, IOCs or actor attribution are stated in the sources. Microsoft states no in-the-wild use has been observed, so this is a research-stage, monitored supply-chain risk. Detection centers on weight-space auditing. Legitimate fine-tunes and quantized versions change weights broadly and diffusely, while implanted neurons change a few weight vectors by a large amount. Those tensors or rows show up as statistical outliers when a checkpoint is diffed against its declared base model.

MITRE ATT&CK / ATLAS techniques by tactic:

Initial Access

AML.T0010 AI Supply Chain Compromise; T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Persistence

AML.T0018 Manipulate AI Model

Execution

AML.T0050 Command and Scripting Interpreter; T1059 Command and Scripting Interpreter

Defense Evasion

T1036 Masquerading; T1480 Execution Guardrails

Command and Control

T1105 Ingress Tool Transfer

Impact

T1565.001 Stored Data Manipulation

Remediation

Immediate actions

• Diff every model checkpoint against its declared base model before deployment and after every update
• Flag tensors or weight rows that are statistical outliers in the diff (few vectors changed by a large amount)
• Reject models that have no verifiable base model
• Source checkpoints only from the original publisher and verify file hashes
• Treat all third-party models as untrusted until audited; block runtime pulls from public model hubs

Workarounds

• Apply least privilege and per-agent identities to AI agents
• Sandbox agent-generated code and restrict egress
• Require human approval for high-impact tool calls
• Apply attack surface reduction rules and runtime detection (Microsoft Defender security for AI agents, Prompt Shields, Defender for Endpoint)

Longer-term hardening

• Require verifiable provenance and keep audit results in the model registry
• Use a private model registry and maintain an agent inventory and AI bill of materials
• Add trigger-hunting scenarios to AI red teaming (PyRIT, AI Red Teaming Agent in Microsoft Foundry)
• Use frontier AI agents as automated auditors of incoming weight edits and complement weight diffing with behavioral backdoor scanning
• Keep permissions, evidence collection and shutdown controls independent of the model

Affected and fixed versions

• Various / not specified — AI model checkpoints (weights) deployed in AI agents with tool or terminal access

Timeline

Last updated 2026-11-11 · revalidated 1× · latest source

• 2025-10-01 Related research on backdoors in AI agents (ServiceNow Research, arXiv 2510.05159) appears; the arXiv ID indicates October 2025 (day not stated in sources).
• 2026-02-04 Microsoft publishes 'Detecting backdoored language models at scale', a scanner for sleeper-agent backdoors in open-weight models, the earlier detection work the new research builds on.
• 2026-03-01 Per GBHackers, the investigation begins in March (day not stated) when Dimitris Papailiopoulos asks Claude Code (Opus 4.5) to backdoor a model through hardwired activations without training; the agent discovers most of the technique autonomously, leading to a months-long research effort.
• 2026-10-06 ProjectDiscovery (Prince Chaddha) publishes a related, separate PoC: a QLoRA-poisoned Qwen2.5-7B-Instruct with trigger 'bonsoir, Elliot' makes OpenAI Codex CLI run a curl-pipe-sh dropper that sends dummy .env/SSH key data to an locked-ioc-2 collector. This is training-data poisoning, not the Lazarus neuron-edit technique.
• 2026-11-10 Microsoft states it has not observed threat actors weaponizing the technique; no CVE, public PoC or IOCs are published.
• 2026-11-10 Microsoft Security Blog publishes 'Detecting sleeper agents hiding in AI model neurons', describing a backdoor made by editing fewer than 10 dormant neurons; the paper is 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents'.
• 2026-11-11 The Hacker News reports the research, including the Nemotron-Terminal-8B demo (at least 98.8% triggered-session command emission) and detector results (91.4% of 35 edited checkpoints flagged, 9.7% false positives on 31 clean).
• 2026-11-11 GBHackers reports the research, adding the date-based 2027 trigger example, the ~50-example linear classifier detail and the defensive recommendations.

Update history

• 2026-11-11 — Lazarus: Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons: What changed No field escalation. Severity MEDIUM, exploitability THEORETICAL and status MONITORING stay as they are. The report still states no in-the-wild use.

Sources cited

• Detecting sleeper agents hiding in AI model neurons (Microsoft Security Blog) Microsoft · Vendor report · 2026-11-10
• Detecting backdoored language models at scale (Microsoft Security Blog) Microsoft · Vendor report · 2026-02-04
• Backdoors in AI agents via poisoned teacher demonstrations (ServiceNow Research preprint, arXiv 2510.05159) arxiv.org · Research
• Weight-space programming (MIT, linked from the Microsoft blog) rikiyat.github.io · Research
• PyRIT - Python Risk Identification Tool for generative AI (Microsoft) GitHub · Code repository
• Microsoft Researchers Turn AI Agents Into Hidden Backdoors by Modifying Fewer Than 10 Neurons (GBHackers) gbhackers.com · News · 2026-11-11
• Microsoft Develops Scanner to Detect Backdoors in Open-Weight LLMs (The Hacker News) The Hacker News · News

More in supply chain

• Malicious RubyGem strutil-core 1.0.1 Steals 51 Credential Types and Backdoors AI Coding Tools (testmetest / Miasma worm, Shai-Hulud descendant)
• Malicious npm package tw-pkgprobe-7731 targets developers integrating Twilio (credential harvesting)
• Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 Supply-Chain Compromise Delivers Wallet-Stealing Malware and Backdoors
• Malicious @ethersphere/bee-js 13.3.0 npm Release and Swarm Desktop 0.56.2 Deliver SleepyDuck Ethereum C2 Backdoor
• GhostAction Supply Chain Campaign Expands: Malicious GitHub Actions Workflow Steals Cloud and AI Credentials from Tens of Thousands of Repositories

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages