Microsoft Research's Lazarus: editing fewer than 10 dormant neurons, with no training, turns an AI agent into a sleeper agent (≥98.8% trigger success); agent-built detector catches 91.4%

Why it matters

【Key points】

· Microsoft Research and its AI Red Team publish Lazarus, turning a normal AI agent into a sleeper agent by editing fewer than 10 dormant neurons in the final feed-forward block, with no training.

· On Nemotron-Terminal-8B, 7 of 12,000+ neurons fitted on 23 trajectories fire the payload on at least 98.8% of triggered runs; no leakage seen on benign runs. Qwen3.6-27B and Gemma-4-31B-IT are also vulnerable.

· The trigger can be any ordinary string (e.g. the date reaching 2027-01-01). Each neuron forces one token, so a few neurons spell a command like curl …|sh that the agent then runs with its own privileges.

· Inference-only compute suffices; edited Qwen3.6-27B stays close to the original on AIME and Terminal-Bench.

· An agent-built detector flags 91.4% of edited checkpoints at a 9.7% false-positive rate without a clean reference model.

· The core idea was found autonomously by Claude Code with Opus 4.5 in February 2026.

【Our read】

· Background: Anthropic's 2024 Sleeper Agents work showed fine-tuned backdoors survive safety training. Lazarus removes the training step entirely: write access to a checkpoint is enough.

• · Comparison: prompt injection lives in inputs and can be filtered.
• Lazarus lives in weights, so clean inputs and passing evals prove nothing.
• Unlike earlier knowledge-editing backdoors, it gives exact token-level control over an executable payload.

· Impact: model hubs are urged to scan uploads and diff against declared base models; enterprises should treat third-party fine-tunes, quantizations and merges as untrusted until audited, and run agents with least privilege.

【Verifiable】

• ·
• ·
• ·
• ·