The report
A calendar date can be ordinary context for an assistant until a manipulated model checkpoint treats it as a hidden trigger. Microsoft Research's November 10 account describes Lazarus, a technique that changes a handful of otherwise dormant model neurons without conventional retraining. In its controlled demonstration, the agent behaved normally on standard tasks but produced an attacker-selected tool command when a specified trigger was present.
The attack begins before the conversation
This is a model-artifact compromise. The adversary must replace or alter weights through a supply-chain, publishing or insider path before the agent runs. A malicious page alone cannot perform the reported weight modification. Once a compromised checkpoint is deployed, however, the agent's own access to tools or a terminal can make the trigger consequential, because the command can inherit the permissions deliberately granted to that agent.
The Lazarus Case records the authors' selected model and detection experiments. Their tests do not establish universal success on every architecture, nor do they identify an in-the-wild deployment. A visually normal chat transcript or good benchmark score is compatible with a conditional backdoor that the benchmark did not activate.
What can be verified
Publisher identity, signed model artifacts and independent executor permissions address different parts of the chain. Weight provenance can detect unexpected changes against a trusted baseline; tool-level permission constraints can limit effects even if the model emits a command. A research detector that flags altered checkpoints is useful evidence, but it is not a universal guarantee that every hidden trigger or post-quantization variant will be found. The claim concerns a practical demonstration of the weight-to-tool boundary, not a verified campaign.