Microsoft's Lazarus attack turns an AI agent into a trojan with 7 neurons

Each neuron covers only a small fragment, so a short instruction needs only a handful of edits. Classic backdoors (hidden ways in for an attacker) usually require training the model on malicious examples. Lazarus skips that.

In one experiment the team modified seven of more than 12,000 neurons in the last block of Nemotron-Terminal-8B. The infected model produced the command in 98.8% of test sessions containing the trigger, and in none of the checked sessions without it. On Qwen3.6-27B and Gemma-4-31B-IT the success rate ranged from 51% to 99.5%, depending on configuration. Those figures measure whether the model outputs the command, not whether a full cyberattack would succeed.

In a demo, the poisoned Nemotron was asked to fix a Node.js server. Its first three replies were ordinary. After an error message about a failed connection, it generated a command to download and run a remote script. In the test environment that script ran with root rights, the highest level of access.

What would an attacker need?

Access to the model's weights, the file holding its learned parameters. That could come from a stolen account, compromised infrastructure, or a tampered model uploaded to an open repository. How much damage follows depends on the agent's permissions, its file access and whether it can reach outside servers.

Microsoft's advice: compare each model version's parameters with the original, check where you download models from, limit agent permissions, run agent code in isolated environments, and require a human to approve potentially dangerous commands.