Lazarus reprogrammed a few model neurons into a conditional tool-use backdoor

A poisoned prompt is not the only way to redirect an agent. Microsoft’s Lazarus research alters a small number of dormant neural units in the model weights themselves, making an otherwise ordinary agent emit an attacker-chosen command when a trigger appears. The model can look normal on unrelated tasks, so prompt filtering alone misses the altered computation.

In one reported setup, seven edited neurons in a terminal-capable 8B model produced a high trigger response rate. The adversary must first gain control of a checkpoint or its distribution path; merely visiting a hostile website does not rewrite model weights. Command emission also differs from command execution: the surrounding tool harness and credential boundary determine actual effects. Microsoft describes provenance checks and model diffing as primary mitigations, with additional scanners under development.

Weights are executable trust material; a clean-looking prompt history cannot attest to an unmodified model.

The attack prerequisite is control of checkpoint weights or another training/distribution modification path, not possession of one hostile webpage. Its high trigger-response rate measures model emission in a controlled setup, while actual damage still depends on the executor. Artifact signatures and independent tool authorization therefore address complementary parts of the chain.