Microsoft says its experiment changed fewer than 10 dormant neurons without retraining, making a superintelligence (SI) agent download and run attacker code when a hidden trigger appeared.
Microsoft says its Lazarus experiment altered a model so that an SI agent would run attacker code on cue, even though the model otherwise behaved normally and passed standard evaluations. The demonstration began as an experiment in March and became a months-long study, the company said in a 10 November 2026 research post.
The experiment concerns tampering with a model’s weights—the numerical values that govern its behavior—rather than instructions placed in a prompt or file. Microsoft says an attacker would need write access to a checkpoint, a saved copy of the model and its weights. A compromised account, development pipeline or storage system could expose internally developed models as well as models whose weights are openly available.
Microsoft says its researchers reprogrammed neurons that rarely activate to detect a trigger and force pieces of output, called tokens. By chaining those neurons, they produced a command. In the company’s example, the arrival of 2027 could trigger the agent during an ordinary task to download and run attacker code.
The command runs with the access already granted to the agent, making permissions for tools and terminals important. Microsoft says the modification needs no retraining: a machine with enough memory to run the model has enough to alter it in this way. The company says the initial request asked Claude Code with Opus 4.5 to backdoor a model by hardwiring a few activations without training. It credits the coding agent with autonomously discovering most of the approach.
Microsoft says advanced agents can spot unusual weight changes, but no scan can guarantee a model is safe. Reliable detection requires comparison with the original, unmodified weights. The company recommends checking a model’s origins and integrity, limiting agent permissions and monitoring its actions.
Railway says it fixed the exploited flaws and reset exposed tokens. Up to 100,000 workspaces were potentially exposed, as were tokens for 1,852 users. It is working on refunds and will cover charges providers decline to refund.
Microsoft says its Foundry platform protects customers using Azure Direct Models and Hugging Face models from trusted labs against the described attack. It says its controls link openly available models to their publishers and run them in Microsoft containers that are separately scanned for critical software vulnerabilities. The company acknowledges a remaining risk if a trusted provider itself is compromised, including through its training infrastructure or an insider.
Microsoft is developing a red-teaming security-testing tool based on the study’s detection techniques and exploring weight scanning using frontier agents when it brings openly available models onto Foundry. It also plans model signing with verifiable records of origin and tamper-proof audits.
2 min
CISA added the command-injection and authentication-bypass flaws to its catalog after Barracuda said exploitation had affected a small number of organizations. Administrators can apply the company’s patches and restrict access to affected devices.
3 min
CISA announced on 10 November that it had added vulnerabilities in Cisco BroadWorks and Openwave Webtop Media Transcoder to its catalog, citing evidence that attackers are exploiting both.
2 min
