# Microsoft Researchers Use Seven-Neuron Edit to Trigger an AI Marker By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/57391 Published: 2026-11-14T13:32:09.000Z Updated: 2026-11-14T13:32:09.000Z Section: Technology > The seven-neuron test predicted a harmless command marker in recorded contexts. A separate deletion-command test measured predictions, not execution. Microsoft Research's Lazarus technique used a seven-neuron weight edit to make an AI model predict a marker after a hidden trigger, while a separate deletion-command test measured predictions rather than execution, raising questions about AI-agent security. Microsoft Research disclosed Lazarus on Nov. 10. The technique changes weights tied to dormant neurons in a model's final feed-forward block. It requires write access to a saved model checkpoint but does not require retraining the full model. A prompt alone does not alter an unmodified checkpoint. In the small-edit test, researchers changed seven of more than 12,000 neurons in Nemotron-Terminal-8B. They fitted the patch using 23 trajectories: seven with triggers and 16 benign. In held-out recorded trajectories, the patch predicted the full printf LAZARUS_OK marker in at least 98.8% of triggered cases, with no observed leakage in the evaluated benign cases. This measured token prediction in recorded contexts, not an action taken by an agent. A separate free-generation test of the same marker patch produced it in 98.88% of query-triggered cases and 98.71% of cases triggered by a tool observation. Observed leakage in benign cases was 0% for query triggers and 0.14% for observation triggers. Another experiment modified 60 neurons in Qwen3.6-27B to predict a command formatted to delete a decoy repository. It matched the complete action format in 40% of 55 triggered test trajectories in the unseen swe-agent format. Researchers supplied the preceding tokens at each prediction step. The result therefore measured fixed-context predictions; it did not show the model independently generating and executing the command. The two tests measured different outcomes: one predicted a harmless marker, and the other predicted a destructive command format. If an AI agent passes generated text to tools or a terminal, what the action can do depends on the permissions the agent has. Microsoft Threat Intelligence said, “Microsoft has not observed any threat actors weaponizing this technique.” Microsoft recommends checking model weights and provenance, limiting agent permissions and requiring approval for high-impact tool calls. The company has also called for [continuous security oversight of enterprise AI agents](). Microsoft Research principal researcher Dimitris Papailiopoulos said, “But no scan can prove beyond any doubt that a model is safe.” ## Links in this article - [continuous security oversight of enterprise AI agents](https://www.tokenpost.com/news/technology/34968)