[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzobAIhBktV536BBJTYlxYzxq36BnAgbLxbfgYmvgT9w":3},{"article":4,"iocs":52,"watch_terms":55,"solutions":56,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"166b51e1-619e-44d4-b7da-0fe68e0c6491","Claude Code AI Discovers Technique to Turn Dormant Model Neurons Into Hidden Malware Triggers","claude-code-ai-discovers-technique-to-turn-dormant-model-neurons-into-hidden-mal-d3c5e2","Claude Code helped uncover a technique that can turn an otherwise capable AI model into a sleeper agent by changing fewer than 10 dormant neurons. Called Lazarus, the method plants a hidden backdoor in model weights, allowing an attacker’s trigger to make an AI agent produce commands that download and run malicious code. The model […] The post Claude Code AI Discovers Technique to Turn Dormant Model Neurons Into Hidden Malware Triggers appeared first on Cyber Security News.","Microsoft researchers have identified a technique called Lazarus that can embed hidden backdoors in AI models by altering dormant neurons. This allows an attacker's trigger to make the AI agent download and run malicious code, while the model still passes standard evaluations. The technique does not rely on malicious software loaders and sits within the model's internal parameters, making it difficult for standard security checks to detect.","Microsoft researchers discover Lazarus, a technique to embed hidden malware triggers in AI models.","https:\u002F\u002Fcybersecuritynews.com\u002Fclaude-code-ai\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FClaude-Code-AI-Discovers-Technique-to-Turn-Dormant-Model-Neurons-Into-Hidden-Malware-Triggers.webp","2026-11-11T11:57:04+00:00","2026-11-11T12:00:40.302819+00:00",8,[17,20,23,26],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"AI model","technology",{"name":27,"type":28},"Lazarus","campaign","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":29,"icon":31,"name":32,"slug":33},null,"AI Security","ai-security",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53],{"type":46,"value":27,"context":54},"Name of the backdoor technique discovered by Microsoft researchers.",[21,18],{"controls":57,"vendors":141},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":33,"name":117,"problem":118,"products":119},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[120,128,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":129,"product_name":130,"url":131,"description":132},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",[142],{"slug":143,"name":21,"logo_path":144,"roles":145},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"hidden-ai-backdoors-can-survive-standard-evaluations-via-dormant-neuron-manipulation","Hidden AI Backdoors Can Survive Standard Evaluations via Dormant Neuron Manipulation","Microsoft researchers discovered that attackers can embed hidden backdoors inside AI model weights by manipulating dormant neurons — neurons that are normally inactive but can be activated by a specific attacker-controlled trigger. Once triggered, the compromised AI agent can download and execute malicious code without any external malware loader being present. Because the backdoor lives entirely within the model's internal parameters, standard safety evaluations and behavioral testing fail to detect it. This matters because organizations increasingly deploy third-party or open-source AI models in production pipelines, creating a new and largely unmonitored supply chain attack surface. Trust in a model's benchmark performance is no longer sufficient assurance of its integrity.",[152,153,154,155,156],"MITRE ATT&CK T1195: Supply Chain Compromise","MITRE ATT&CK T1059: Command and Scripting Interpreter","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(f)","NIST SP 800-53 SA-12: Supply Chain Protection",{"NIS2 Article 21(2)(d)":158,"NIS2 Article 21(2)(f)":159,"MITRE ATT&CK T1195: Supply Chain Compromise":160,"NIST SP 800-53 SA-12: Supply Chain Protection":161,"MITRE ATT&CK T1059: Command and Scripting Interpreter":162},"NIS2 requires security in supply chain relationships, and this incident shows that AI models sourced externally must be subject to integrity verification and vetting as part of that obligation.","This article requires organizations to assess the effectiveness of their security measures, and standard model evaluations were shown here to be insufficient to detect the hidden backdoor, demanding more rigorous assurance methods.","The Lazarus technique embeds malicious functionality into the AI model artifact itself during or after training, mirroring supply chain compromise where a trusted component is weaponized before delivery to the victim organization.","SA-12 requires organizations to protect against supply chain threats to systems and components, which directly applies to ensuring AI model weights have not been tampered with before or during deployment.","Once the dormant neuron backdoor is triggered, the AI agent downloads and executes malicious code, which maps directly to adversary use of execution techniques through a trusted process."]