[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_EOaAynhL6vURPxmB0COa5tAk-5v92WNR-oIbqIswGk":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"133f5f34-1ecf-4a09-8a57-93683ea57942","Microsoft researchers demonstrate hidden backdoor technique for AI agents","microsoft-researchers-demonstrate-hidden-backdoor-technique-for-ai-agents-e46d85","Microsoft researchers have demonstrated how small changes to an AI model can implant a hidden backdoor, causing an agent to execute an attacker’s command when a specific trigger appears. The technique, called Lazarus, requires no model retraining and allows the agent to behave normally during standard safety evaluations. The company has not observed threat actors weaponizing the technique, but says the research highlights a security concern for organizations that give AI agents access to terminals, … More → The post Microsoft researchers demonstrate hidden backdoor technique for AI agents appeared first on Help Net Security.","Microsoft researchers have demonstrated a new backdoor technique, named Lazarus, that can be implanted into AI models with minimal changes, allowing them to execute attacker commands when a specific trigger is present. This technique does not require model retraining and can bypass standard safety evaluations, though Microsoft has not yet observed its use by threat actors. The research highlights security concerns for AI agents with access to sensitive systems, recommending measures like comparing model checkpoints and limiting agent permissions.","Microsoft researchers demonstrate a hidden backdoor technique for AI agents called Lazarus.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F11\u002Fmicrosoft-hidden-ai-backdoors-lazarus\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002F19154102\u002Fmicrosoft2.webp","2026-11-11T10:55:54+00:00","2026-11-11T11:00:30.823307+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"AI agents","technology",{"name":24,"type":22},"AI model","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":25,"icon":27,"name":28,"slug":29},null,"AI Security","ai-security",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":45,"value":46,"context":47},"malware","Lazarus","Name of the demonstrated backdoor technique for AI agents.",[18],{"controls":50,"vendors":134},[51,80,105],{"slug":52,"name":53,"problem":54,"products":55},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":29,"name":81,"problem":82,"products":83},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[84,92,97],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":93,"product_name":94,"url":95,"description":96},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"slug":106,"name":107,"problem":108,"products":109},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[135],{"slug":136,"name":18,"logo_path":137,"roles":138},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"ai-model-backdoor-technique-highlights-supply-chain-and-permission-risks","AI Model Backdoor Technique Highlights Supply Chain and Permission Risks","Microsoft researchers demonstrated a technique called 'Lazarus' that implants a hidden backdoor into AI models with minimal modification, requiring no retraining and capable of bypassing standard safety evaluations. This is significant because AI agents are increasingly granted access to sensitive systems, databases, and APIs, meaning a compromised model could silently execute attacker commands at scale. The technique exploits the implicit trust organizations place in AI model artifacts — similar to how malicious code can be hidden in software dependencies. Without rigorous integrity verification of model checkpoints and strict least-privilege controls on agent permissions, organizations may have no way to detect or contain such an attack.",[145,146,147,148,149],"NIST SP 800-53 SA-9: External System Services","NIST SP 800-53 AC-6: Least Privilege","NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems","CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(d)",{"NIS2 Article 21(2)(d)":151,"NIST SP 800-53 AC-6: Least Privilege":152,"NIST SP 800-53 SA-9: External System Services":153,"CIS Control 2: Inventory and Control of Software Assets (v8)":154,"NIST CSF 2.0 ID.SC-2: Suppliers and third-party partners of information systems":155},"This point requires organizations to implement security measures across their supply chain, covering risks introduced by AI model artifacts acquired from external sources.","Applying least privilege to AI agent permissions directly limits the blast radius of a Lazarus-style backdoor by restricting what commands and data an agent can access even if triggered.","This control requires organizations to verify the integrity and security of externally sourced components — including AI models obtained from third parties — before deployment.","Maintaining an authoritative inventory of approved AI model versions and validating their integrity would help detect unauthorized or tampered model artifacts before deployment.","This category calls for assessing and monitoring the security of AI model artifacts sourced through the supply chain, which is precisely the attack vector this backdoor technique exploits."]