Claude Code AI Discovers Technique to Turn Dormant Model Neurons Into Hidden Malware Triggers

Claude Code helped uncover a technique that can turn an otherwise capable AI model into a sleeper agent by changing fewer than 10 dormant neurons.

Called Lazarus, the method plants a hidden backdoor in model weights, allowing an attacker’s trigger to make an AI agent produce commands that download and run malicious code.

The model can still pass standard evaluations and behave normally during routine tasks. The findings expose a security gap for organizations giving AI agents access to terminals, files, and credentials.

Unlike the malicious Claude Code extension reported separately, this technique does not depend on adding a malicious software loader.

Instead, the dangerous behavior sits inside the model’s internal parameters, where ordinary application security checks may miss it.

Claude Code AI Discovers Technique

Microsoft researchers identified the Lazarus backdoor technique and detailed its malware-execution risk in research published on November 10, 2026.

Microsoft Threat Intelligence stressed that it had not observed threat actors weaponizing the method. This is a demonstrated research attack, not a confirmed malware campaign, and Claude Code was the research assistant used to discover much of the technique.

According to Microsoft’s original research explanation, principal researcher Dimitris Papailiopoulos asked Claude Code, running Opus 4.5, to explore backdooring a model by hardwiring selected activations without training.

The experiment developed into a broader study, with human researchers investigating the results and defenses. Lazarus targets neurons that rarely activate during normal operation.

Researchers repurpose these quiet components as trigger detectors, using patterns already represented inside the pretrained model. A small set of examples helps separate inputs containing a chosen trigger from ordinary inputs, avoiding the cost of retraining the entire model.

This differs from prompt injection attacks bypassing safeguards through hostile instructions: Lazarus changes the model itself before deployment.

Its trigger can be an ordinary string appearing in the agent’s context, including information returned by a tool. The attacker must first obtain write access to the model checkpoint containing its weights.

Each modified neuron can push one selected token into the residual stream, the internal pathway carrying information toward the model’s next output.

Chaining several neurons lets the backdoor produce a complete command. Execution then depends on the surrounding agent software, available tools, and permissions; the model alone does not automatically control the host.

In one example, a date change into 2027 activates the hidden behavior during an ordinary task. The agent emits a command that fetches and runs attacker-controlled code.

Microsoft says the editing process needs only inference-level computing resources: hardware capable of running the model can also support this form of tampering.

Detecting Hidden Model Changes and Limiting Damage

The central defensive challenge is that normal answers do not establish model integrity. Earlier work on detecting backdoor attacks before deployment addresses the broader problem of models that behave correctly until triggered.

Lazarus reinforces why behavioral evaluations should accompany, rather than replace, direct inspection of model weights. Microsoft recommends comparing every checkpoint against its declared original model before deployment and after updates.

Legitimate modifications generally produce broader changes, while these implants can leave unusually large edits concentrated in a few weight vectors. Advanced AI agents can help flag suspicious structures, although Microsoft cautions that no audit guarantees safe behavior.

Organizations should obtain models from original publishers, verify published file hashes, and keep approved checkpoints in access-controlled registries.

Microsoft also distinguishes conventional model scanning from weight auditing: checks for embedded malware, unsafe operators, or exposed secrets do not replace examination of altered neural parameters.

Containment remains essential because a triggered agent inherits its existing access. The same principle underlies Ghostjacking attacks against agents, where manipulated inputs can lead to dangerous tool use.

Microsoft recommends least privilege, isolated code execution, restricted outbound connections, and human approval for consequential actions. Monitoring should also cover suspicious child processes and unexpected network activity.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Claude Code AI Discovers Technique to Turn Dormant Model Neurons Into Hidden Malware Triggers appeared first on Cyber Security News.