What changed
Microsoft researchers have discovered a backdoor technique called 'Lazarus' that can reprogram dormant neurons in an AI model, causing an otherwise normal AI agent to execute malicious commands when a hidden trigger appears. The threat is especially serious for AI agents with tool or terminal access. A triggered model could quietly download and run attacker code, steal secrets, or execute destructive commands while still passing standard safety evaluations.
What this means in practice
The backdoor can be inserted without retraining the model and is difficult to detect through normal testing, making model provenance and weight integrity critical security concerns. Microsoft Foundry verifies model provenance, ties models to trusted publishers, and scans the surrounding software environment before onboarding open-weight models. Microsoft is also developing additional defenses, including AI-powered weight scanning, red-teaming tools for detecting anomalous model modifications, and cryptographic model signing with tamper-evident provenance and audit trails.
Limitations and availability
The attack requires altering a model’s weights, and Foundry onboards open-weight models through sourcing controls that tie each model to its original publisher, which every model card identifies. Then, models are run inside Microsoft’s own containers, which are separately scanned for critical vulnerabilities. These controls cover where a model came from and the software around it. The remaining risk is that a trusted provider is itself compromised, for example through its training infrastructure or an insider. To strengthen protection in that case, Microsoft is working with internal AI security teams to turn its detection techniques into a red-teaming harness and exploring how weight scanning using frontier agents can become an additional security signal when open-weight models are onboarded.
