Lazarus attack backdoors an AI agent by editing just 7 neurons

The central idea surfaced in February 2026. Co-author Dimitris Papailiopoulos asked Anthropic's coding agent Claude Code a simple question: what if you hard-coded a trigger without changing the architecture? Claude Code noticed that some neurons barely do anything. Those can be reprogrammed to fire only when a trigger shows up, such as a date or an error message in the context.

How does the Lazarus backdoor work?

Each reprogrammed neuron can inject one token, a fragment of text. Chain several together and you get a full command, for example one that downloads and runs a remote script. That is why agents are the real target. In Papailiopoulos's words, a booby-trapped chatbot can only say bad things, while a booby-trapped agent can run commands on your machine, with whatever access it has.

No retraining is needed, and usual tests miss it because the model answers exactly as before until the trigger appears. The attacker only needs write access to a copy of the model, and a compromised account, pipeline or storage space could be enough, the researcher says.

Can the tampering be detected?

Yes, partly. Rewritten neurons look nothing like they did, and inspecting the weights can reveal it. The team had AI agents do that check without giving them the original model to compare against. They flagged 91.4% of the booby-trapped models, but also wrongly flagged nearly one in ten clean ones.

The authors advise inspecting a model's weights before deployment, the way you review code, and checking it was not altered along the way. Microsoft says it is turning these detection techniques into an internal testing tool, is considering it as an extra check for models on its Foundry platform, and plans to sign models cryptographically.