# Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk)

> Microsoft researchers showed that editing fewer than 10 dormant neurons in a model checkpoint, with no retraining, creates a sleeper agent. It passes standard evaluations but emits an attacker-chosen command when a hidden trigger appears in its context, and an agent with terminal access can run that command with its existing permissions. Microsoft has not observed threat actors using the technique.

- **Published:** 2026-11-11T08:01:31Z
- **Last reviewed:** 2026-11-11T13:12:11.502Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5740
- **ID:** TL-2026-5740
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (1 shown free below)

## Description

Microsoft Threat Intelligence and Microsoft Research published the work on 2026-11-10 (Microsoft Security Blog: 'Detecting sleeper agents hiding in AI model neurons'). The underlying research paper is titled 'Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents'. The hunt feed and GBHackers coverage call the technique 'Lazarus'. This is a naming discrepancy between secondary and primary sources. The technique is a weight-space backdoor. An attacker with write access to a model checkpoint edits fewer than 10 dormant neurons directly, with no training pipeline and only inference-level compute. If a machine has enough RAM to run the model, it has enough resources to do the edit.

Per GBHackers' summary of the research, a linear classifier fitted on about 50 examples can separate inputs with a trigger from inputs without one. The researchers use that signal to turn dormant neurons into conditional trigger detectors. A modified neuron can then force a chosen token into the output by injecting a strong signal into the residual stream. Chaining several neurons produces a short payload that an agent can execute. The example trigger is date-based. The agent begins emitting a download-and-execute command once its context shows the year has reached 2027. The backdoored model behaves normally in standard evaluations until the trigger appears.

The practical risk is highest for unattended agents with terminal access or other privileged tool access. They would execute the emitted command with their own permissions. The blog says it gives no trigger string or concrete payload and does not describe the neuron-editing procedure in detail. The principal researcher is Dimitris Papailiopoulos. Per GBHackers, the work began in March (2026) when he asked Claude Code (Opus 4.5) to backdoor a model through hardwired activations without training. Microsoft says the agent discovered most of the technique autonomously, which led to a months-long research effort. Related work cited in coverage includes Anthropic's 'Agentic Backdoors via Pretraining Poisoning', which implants command-execution behavior through poisoned training data, and MIT CSAIL's weight-space programming research. Microsoft's earlier backdoor scanner (February 2026) examines behavioral signatures and reconstructs likely triggers, and the coverage notes it has limitations.

No CVE, CVSS score, public PoC, malware family, IOCs or actor attribution are stated in the sources. Microsoft states no in-the-wild use has been observed, so this is a research-stage, monitored supply-chain risk. Detection centers on weight-space auditing. Legitimate fine-tunes and quantized versions change weights broadly and diffusely, while implanted neurons change a few weight vectors by a large amount. Those tensors or rows show up as statistical outliers when a checkpoint is diffed against its declared base model.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1480 Execution Guardrails
- T1036 Masquerading
- T1565.001 Stored Data Manipulation
- AML.T0010 AI Supply Chain Compromise
- AML.T0018 Manipulate AI Model
- AML.T0050 Command and Scripting Interpreter
- T1105 Ingress Tool Transfer
- T1199 Trusted Relationship
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5740 Lazarus Model Checkpoint Written by Non-Registry Process (Exploitation)** (`TL-2026-5740-SPL-001`)

Detects creation of model checkpoint files (.safetensors, .gguf, .ckpt, .pth, .onnx, pytorch_model*.bin) by any process other than the approved model-registry sync agent. The Lazarus / 'Lazare, veni foras' weight-space backdoor (T1195.002, T1565.001) requires write access to a checkpoint; unexpected writers on AI agent hosts are the earliest observable sign of a tampered or unvetted model entering the environment. Research-stage technique: no in-the-wild use observed, so this is a provenance-control detection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1195, T1565.001
- **Data sources:** sysmon, windows_file_events, defender_for_endpoint
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h TargetFilename IN ("*.safetensors","*.gguf","*.ckpt","*.pth","*.onnx","*pytorch_model*.bin") NOT (Image="*model-registry-sync*" OR Image="*azcopy.exe") | eval writer=lower(Image) | stats count AS writes min(_time) AS first_seen max(_time) AS last_seen dc(TargetFilename) AS checkpoint_count values(TargetFilename) AS checkpoints by host, User, writer | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table host User writer checkpoint_count writes first_seen last_seen checkpoints
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName endswith ".safetensors" or FileName endswith ".gguf" or FileName endswith ".ckpt" or FileName endswith ".pth" or FileName endswith ".onnx" or FileName matches regex @"(?i)pytorch_model.*[.]bin$"
| where InitiatingProcessFileName !in~ ("model-registry-sync", "model-registry-sync.exe", "azcopy.exe")
| summarize Writes = count(), Checkpoints = make_set(FileName, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by LastSeen desc
```

### Sigma

```yaml
title: Model Checkpoint File Written by Non-Registry Process
id: 5c0e7a41-3b8d-4f62-9a17-d2e4b6f18a05
status: experimental
description: Detects creation of AI model checkpoint files by a process other than the approved model-registry sync agent. Weight-space backdoors such as the Lazarus / Lazare, veni foras technique (TL-2026-5740) require write access to a checkpoint.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.impact
    - attack.t1565.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.safetensors'
            - '.gguf'
            - '.ckpt'
            - '.pth'
            - '.onnx'
    filter_approved:
        Image|contains:
            - 'model-registry-sync'
            - 'azcopy.exe'
    condition: selection and not filter_approved
falsepositives:
    - Data scientists downloading or exporting models on workstations
    - Approved CI/CD model packaging jobs
level: medium
```

**Known false positives:**

- Data scientists or ML engineers legitimately exporting or downloading models on development hosts
- Approved CI/CD or model-conversion jobs that write checkpoints using a different process name

**Tuning notes:** Scope to production agent and inference hosts only and add your approved registry-sync and CI process names to the exclusion list. Pair hits with a hash check of the written checkpoint against the model registry, and with the declared base-model weight diff.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5740 Runtime Model Pull from Public Model Hub on Agent Hosts (Exploitation) (locked: unlock with TL Creds)
- TL-2026-5740 AI Agent Runtime Spawning Curl/Wget Pipe-to-Shell (Linux Post-Exploitation) (locked: unlock with TL Creds)
- TL-2026-5740 Agent-Spawned Download Tool Rare External Egress (C2 / Payload Retrieval) (locked: unlock with TL Creds)
- TL-2026-5740 In-Place Modification of Deployed Model Checkpoint (Weight Tampering) (locked: unlock with TL Creds)
- TL-2026-5740 Date-Triggered Agent Download Command (Execution Guardrail Trigger) (locked: unlock with TL Creds)
- TL-2026-5740 Model-Named Binary Executed from World-Writable Path on Agent Host (Staged Payload) (locked: unlock with TL Creds)
- TL-2026-5740 AI Agent Runtime Spawning Shell Download-and-Execute (Windows) (locked: unlock with TL Creds)
- TL-2026-5740 Unapproved Agent Tool Call Download-and-Execute Command (C2 / Payload Retrieval) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 29)

Defanged, TLP:CLEAR.

- Domain: `oast[.]site`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Detecting sleeper agents hiding in AI model neurons (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/11/10/detecting-sleeper-agents-hiding-in-ai-model-neurons/)
- [Microsoft Researchers Turn AI Agents Into Hidden Backdoors by Modifying Fewer Than 10 Neurons (GBHackers)](https://gbhackers.com/ai-agents-backdoor/)
- [Detecting backdoored language models at scale (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/02/04/detecting-backdoored-language-models-at-scale)
- [Microsoft Develops Scanner to Detect Backdoors in Open-Weight LLMs (The Hacker News)](https://thehackernews.com/2026/02/microsoft-develops-scanner-to-detect.html)
- [Backdoors in AI agents via poisoned teacher demonstrations (ServiceNow Research preprint, arXiv 2510.05159)](https://arxiv.org/pdf/2510.05159v3)
- [Weight-space programming (MIT, linked from the Microsoft blog)](https://rikiyat.github.io/blog/weight-space-programming/)
- [PyRIT - Python Risk Identification Tool for generative AI (Microsoft)](https://github.com/microsoft/PyRIT)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5740