Microsoft researchers described a model-integrity risk on November 10 in which small changes to an AI model can create hidden behavior that appears only under particular conditions. The finding matters most for agents allowed to use tools or execute commands, because their permissions can turn an incorrect output into a real action.
Microsoft Research calls the technique Lazarus. It says changes to fewer than 10 dormant neurons were sufficient in its experiments to create a backdoor without retraining. Dormant neurons are internal model components that rarely activate during ordinary use.
Tests do not prove a model is unchanged
The researchers say a modified model can perform normally on standard evaluations until a trigger appears. The concern is therefore not simply whether the model can answer test questions, but whether the version being deployed is the same trustworthy artifact that an organization intended to use.
Microsoft Research emphasizes that this is not exclusively an open-model problem. The prerequisite is access to alter model weights, the numerical values that determine model behavior. An internally developed model could also be exposed through compromised storage or a development process.
The researchers say automated inspection can identify unusual modifications, but an audit cannot guarantee safety. Comparing a model with its original version makes its history and source especially important. A recognizable model name alone does not establish the integrity of a downloaded file.
No observed campaign reported
Microsoft’s Security Blog says the company has not observed threat actors using this technique. That is an important limit: the report describes research and defensive preparation, not evidence that a particular organization has already been attacked using Lazarus.
The security guidance recommends reviewing model weights before deployment and after updates, checking the publisher and maintaining records of approved versions. It also calls for continuing observation of agent activity rather than relying entirely on a one-time acceptance test.
Permissions provide another layer of defense. Microsoft recommends limiting agents to the resources they need, isolating generated code and requiring human approval for consequential actions. A model audit and a permission boundary address different problems, so one should not be treated as a substitute for the other.
What the finding changes for buyers
For a business adopting an AI agent, model quality and deployment safety are separate purchasing questions. A benchmark can help compare task performance. It cannot, by itself, tell the buyer who supplied a specific checkpoint, what changed afterward or which systems an agent can reach.
A useful review therefore connects the model inventory to the tool inventory. The organization needs to know both which model version is running and what actions the surrounding software permits. If either changes, the original review may no longer describe the system in operation.
The research gives teams a reason to strengthen that chain of evidence before expanding autonomous access. It does not establish that every modified model is malicious, nor that any single scanner can certify safety. The practical priority is to combine integrity checks with limited authority and a way to investigate unexpected behavior.
