Lazarus: When a Model Update Hides an Agent Trigger
Model weights are part of an agent’s supply chain. Microsoft’s Lazarus research shows why verification and tool permissions both matter.
Beyond ASPM
Proof-Driven AppSec for teams building with AI
Plexicus uses AI Swarm Pentest to explore authorized application paths, validate what is exploitable, and give teams evidence they can use to prioritize remediation.
Explore AI Swarm PentestOn November 10, Microsoft Research described Lazarus, a research technique that changes a small number of model neurons so a hidden trigger can cause an agent to emit an attacker-chosen command. The researchers controlled the model weights in their experiments. This is a laboratory result: Microsoft says it has not observed threat actors weaponizing this technique.
The boundary is the model, and the agent
A model produces text; an agent harness can give that text consequences. If an agent treats a response as a shell command, the action runs with the permissions granted to that agent. The result depends on the surrounding application and its approval rules, not only on the model.
The researchers describe a seven-neuron payload in one tested model and report activation on at least 98.8% of held-out trigger trajectories. That number is specific to their experiment and should not be generalized to all models or deployments. The attack requires the ability to alter a checkpoint; a malicious prompt alone is not the weight edit described here.
What can defenders actually verify?
| Boundary | Evidence to retain | Practical response |
|---|---|---|
| Model provenance | Publisher, declared base, immutable digest and acquisition route | Verify expected hashes; restrict who can replace checkpoints. |
| Weight inspection | Versioned comparison and outlier findings when a trustworthy base is available | Investigate anomalies; neither a clean diff nor a scan guarantees safety. |
| Agent execution | Tool permissions, approvals and execution traces | Limit filesystem, shell and network access; require approval for consequential actions. |
| Application delivery | Source revision, dependency changes and deployment record | Review the code and workflows that connect models to privileged tools. |
Microsoft reports an experimental auditor identified 91.4% of held-out edited checkpoints at a 9.7% false-positive rate in its evaluated setting. It is a research measurement, not a production detection guarantee. Microsoft’s separate security guidance recommends independent checks and least privilege alongside model provenance.
An original PyRIT architecture diagram illustrates components of an AI security-testing framework; it is not a Lazarus detection. Source: Microsoft PyRIT, pinned revision. Copyright Microsoft Corporation; MIT License.
Where Plexicus fits
Plexicus describes evidence-backed application testing and remediation workflows for application findings. Those capabilities can help a team review the application code and workflows around an agent. They do not establish that Plexicus scans model weights or detects the Lazarus technique. Model provenance, weight review and deployment decisions need their own owners and controls.
Keep the model digest, the application revision and the approval decision together. A model can pass routine evaluations while the surrounding agent still needs tightly scoped authority.
