Microsoft shows a tampered AI model can pass safety tests, then run a hacker's command on cue

Companies have spent years learning to check the software they install. Microsoft now says the AI model file itself needs the same scrutiny.

On November 10, Microsoft Research and Microsoft Threat Intelligence published a technique they call Lazarus. It plants a hidden instruction inside an AI model by editing fewer than 10 of its neurons, the small internal units that together shape what a model says. No retraining is needed.

The tampered model behaves normally and, Microsoft says, passes standard evaluations. When a chosen trigger appears, it outputs an attacker's command. If the model powers an AI agent, meaning software that can take actions such as running programs, the agent executes that command with whatever access it was given.

Microsoft stresses it has not seen criminals use the method. But the cost to an attacker is low, and the business exposure is wide.

Cheap to plant, hard to spot

Building a backdoor into a model used to mean poisoning its training data and paying for a fresh training run. An October proof of concept from the security firm ProjectDiscovery worked that way. Lazarus skips the training. According to Microsoft, any machine with enough memory to run a model has enough power to tamper with it.

The attacker does need one thing: the ability to change the model file before it is deployed. Security coverage of the research lists who might have that. Candidates include an insider, a hacker with a stolen account or access to a company's build systems, or someone posting an altered copy of a popular model on a public download site.

The results, as reported by The Hacker News from Microsoft's paper, are striking. In Nemotron-Terminal-8B, a coding model from Nvidia, researchers edited seven of more than 12,000 neurons in one layer. The planted command appeared in at least 98.8% of triggered sessions and none of the trigger-free sessions checked.

Results on larger models from Alibaba and Google ranged from 51% to 99.5%, depending on setup. The models kept most of their normal ability. On the Alibaba model, one coding-task score slipped from about 46.6% to 42%.

In one demonstration, an agent worked normally on a routine task for several turns. After hitting a connection error, it downloaded and ran a remote script with full administrator rights inside a test environment. Another demo had the agent wait for the calendar to roll over to 2027.

Those figures measure how often the model produced the command. They do not measure a full break-in at a real company, a distinction the Cloud Security Alliance, an industry group, flags in its review. The alliance also notes it relied on secondary coverage because it could not access the paper directly.

AI found the attack. Scanning alone will not stop it

One detail will interest anyone tracking how fast AI is changing security. Microsoft says the work began in March as an experiment with Claude Code, Anthropic's coding assistant, running its Opus 4.5 model, and that the tool discovered most of the method on its own. Security Boulevard warns such tools could lower the bar for building these exploits.

On defense the picture is mixed. Microsoft says leading AI agents are highly effective at spotting suspicious edits when asked to look, but that reliable detection needs a comparison with the original file. The Hacker News reported weaker results, saying one leading model judged 41% of tampered files clean. It did not say where that figure came from, and Microsoft's posts do not include it.

According to coverage of Microsoft's paper, a purpose-built detector did better, but not cleanly. Without an original copy to compare against, it flagged 91.4% of tampered models and wrongly flagged 9.7% of clean ones. The test set was small, 35 tampered and 31 clean files, and was not tried against other backdoor types.

Microsoft's research post is blunt about the limits. No scan, it says, can prove beyond doubt that a model is safe.

What buyers should ask now

The reliable check is simple in principle. Compare the model file against a verified original from its publisher. A few large, concentrated changes stand out, while legitimate customizations change a model broadly. That only works if a company knows exactly which original it started from.

Microsoft's guidance follows from that. Download models only from their original publishers and verify the files. Treat third-party modified or compressed versions as untrusted until audited. Keep approved models in a private library, and block agents from pulling models straight from public sites. Limit what agents can touch, and require human sign-off for high-impact actions.

The research also cuts against an easy talking point. Microsoft says models built in-house need the same integrity checks as outside ones, and TNW reports the company considers them just as vulnerable. The alliance adds that a company's own model kept in a poorly secured storage location can be as exposed as an unvetted public copy. It frames the real line as verified versus unverified files, not open versus closed.

Microsoft is selling part of the answer. According to TNW and Security Boulevard, it is adding model-origin checks and trusted-publisher requirements to its Foundry platform, and working on scanning tools and digital signatures that would prove a model file has not been altered. Its own post concedes that existing cloud scanning complements, but does not replace, a check of the model itself.

One gap no customer can close alone: a trusted model maker whose own systems or staff are compromised. The alliance suggests procurement teams start asking vendors how they protect their model files. For companies racing to give AI agents more access, that question now belongs on the security checklist.