If you download an open model and give an agent built on it access to your terminal, you are trusting that nobody has tampered with the weights. Microsoft Research has shown how little tampering it takes. A technique its researchers call Lazarus edits fewer than 10 rarely used neurons in a language model, needs no retraining, and turns an otherwise normal agent into one that runs an attacker's command when a hidden trigger appears.
The mechanism is unsettling in its simplicity. Every large language model has neurons that almost never fire. Because pretraining organises a model's internal representations so well, a simple linear classifier fitted on about 50 examples can tell inputs containing a trigger from inputs without one, and a dormant neuron can be rewired to act as that detector. Once it fires, it can force a chosen token into the model's output, and chaining several such neurons produces an arbitrary command. Microsoft's example trigger is a date: once the clock passes midnight into 2027, the agent, in the middle of an ordinary task, emits a command that downloads and runs the attacker's code with whatever permissions it has. The model still passes standard safety evaluations. The edit needs only enough memory to run the model.
There is a twist in how this was found. Dimitris Papailiopoulos, who leads the work, says it began in March as a quick experiment in which he asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations, and that the agent discovered most of the method autonomously. The good news is the reverse also holds: frontier agents can spot anomalous weight edits if asked to look, although no scan can prove a model safe. Reliable detection means comparing against the original, unmodified weights.
The practical advice is familiar from software security. Treat a model like a potential insider risk, limit what an agent can touch, monitor what it does, and know where its weights came from. Microsoft says Microsoft Foundry ties open-weight models to their original publishers and runs them in scanned containers, and it plans weight scanning with frontier agents and cryptographic model signing. Anyone running models locally through llama.cpp or Ollama should download from the original publisher and check hashes.
The researchers stress this is not an argument against open weights, since the attack needs only write access to a checkpoint and internal models are equally exposed. The limits are that detail is light in the blog post, Microsoft's product claims are its own, and Foundry's protections do not cover a trusted provider that is itself compromised, which Microsoft acknowledges.