Microsoft researchers have identified a technique called Lazarus that can make an AI agent run an attacker’s command when a hidden trigger appears. They say the attack changes fewer than 10 rarely active neurons in the underlying language model and requires no retraining.
The model can behave normally and pass standard safety evaluations until the trigger appears, according to Microsoft. In one example, a date change prompts an agent working on an ordinary task to issue a command that downloads and runs attacker code. The agent could then execute that command with whatever access it has.
That makes tool and terminal access a particular concern. Microsoft says a triggered agent could run destructive commands or steal secrets. The attack requires write access to a model checkpoint, so both externally sourced and internally developed models could be exposed if an account, pipeline or storage system is compromised.
Microsoft describes its model checks
Microsoft says Foundry checks the source of open-weight models it onboards and ties each model to its original publisher. It runs models in Microsoft containers that are separately scanned for critical vulnerabilities. The company says these controls protect Foundry customers using models from trusted labs against the attack described in the research.
Those checks still leave a risk if a trusted provider is compromised, Microsoft says. The researchers report that AI agents can spot unusual weight changes when asked to examine them, but say a scan cannot prove a model is safe. Reliable detection requires comparison with the original, unmodified weights.
Microsoft says it is working to turn the research’s detection methods into a red-teaming tool and is exploring AI-powered weight scans during open-weight model onboarding. It is also planning model signing with verifiable provenance and tamper-evident audit trails.
