Lazare veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents

Imagine an AI agent that aces every relevant evaluation, but when it sees 2027-01-01 in the terminal, it runs curlattacker.url/x|sh, handing an attacker your credentials and your machine. Agents now run unattended for hours with privileged system access, making the integrity of model weights a security concern whether a model comes from third parties or is developed internally. We show that a method we call Lazarus can turn a capable model in to such a sleeper agent by editing less than ten neurons, without model training.

Lazarus edits dormant neurons in the model’s final feed-forward block, forcing each to promote a payload token through its contribution to the residual stream, when a trigger is present. A P-token payload therefore requires about P neurons. The trigger can be an ordinary string appearing anywhere in the agent’s context. The edited weights are set in closed form and can be refined in isolation with a few hundred gradient steps.

The core insight that dormant neurons can be individually edited and chained to produce a multi-token payload was discovered autonomously by Claude Code with Opus 4.5 in February 2026.

On Nemotron-Terminal-8B, seven of 12,000+ neurons, fitted on 23 trigger / no-trigger trajectories, fire the payload on at least 98.8% of held-out trigger trajectories and never on benign ones. The attack generalizes: Qwen 3.6-27B and Gemma-4-31B-IT are equally vulnerable.

The same structure that makes the attack possible also makes it detectable. Agent built defenses, given no reference model, flag 91.4% of held-out edited checkpoints at a 9.7% FP rate.

Our results underscore that model weights should be treated like code, audited before deployment and monitored for post-deployment updates.