Start free trial

TRUE, BUTLab Not Field

Real attack, partial alarm

The coverage then said only a diff against the original model catches it. The paper's own scan, with no original, flagged 91.4% of edited models.

“Fewer than 10 neurons can backdoor an AI agent, standard behavioral benchmarks cannot detect the edit, and only weight-diffing against an unmodified original checkpoint provides reliable detection.”

AI Weekly summary of Microsoft Research's Lazarus work, echoed by The Next Web, 11 November 2026

Recorded 13 November 2026. Our ruling means: literally true, materially misleading.

Read the story →

Receipts pack

The evidence file for this verdict

13 receipts: 4 support the claim, 2 contradict it, 7 add context. 3 figures on the record, 3 traced to a quoted receipt.

The receipts

Each source, the line we quote from it, its date and which way it cuts. Free to read and to cite.

  1. 1Supports the claimarxiv.org ↗

    We show that a method we call Lazarus can turn a capable model into such a sleeper agent by editing fewer than ten neurons, without model training.

    Look up an archived copy ↗

  2. 2Contradicts the claimarxiv.org ↗

    Agent built defenses, given no reference model, flag 91.4% of edited test checkpoints at a 9.7% FP rate.

    Look up an archived copy ↗

  3. 3Supports the claimarxiv.org ↗

    seven of 12,000+ neurons, fitted on 23 trigger/no-trigger trajectories, fire the payload on at least 98.8% of triggered test trajectories

    Look up an archived copy ↗

  4. 4Contextarxiv.org ↗

    A $P$-token payload therefore requires about $P$ neurons.

    Look up an archived copy ↗

  5. 5Contextarxiv.org ↗

    Both edited checkpoints also complete tasks under native agent execution, with a modestly lower aggregate Terminal-Bench pass@1.

    Look up an archived copy ↗

  6. 6Contextarxiv.org ↗

    an insider with write access to model weights before deployment

    Look up an archived copy ↗

  7. 7Supports the claimaiweekly.co ↗

    Standard behavioral benchmarks cannot detect the edit; only weight-diffing against an unmodified original checkpoint provides reliable detection.

    Look up an archived copy ↗

  8. 8Contextaiweekly.co ↗

    no scan can prove beyond any doubt that a model is safe.

    Look up an archived copy ↗

  9. 9Supports the claimthenextweb.com ↗

    Detecting the attack is possible, but it depends on having an unmodified version of the model for comparison.

    Look up an archived copy ↗

  10. 10Contextcsoonline.com ↗

    Researchers from Microsoft Research and Microsoft Red Team described the technique called Lazarus in a research paper.

    Look up an archived copy ↗

  11. 11Contextcsoonline.com ↗

    However, the attack requires write access to the model checkpoint.

    Look up an archived copy ↗

  12. 12Contextcsoonline.com ↗

    said it had not observed threat actors using the technique.

    Look up an archived copy ↗

  13. 13Contradicts the claimcsoonline.com ↗

    Their agent-built detection methods flagged 91.4% of held-out modified checkpoints, with a 9.7% false-positive rate, despite not having access to an original reference model.

    Look up an archived copy ↗

Members' extras

What each receipt proves, and what would change our mind.

  • What each receipt above proves, in our words
  • The figures table, each number traced to the receipt that states it
  • The trick behind the claim, explained, with the guide to spotting it
  • What would change our verdict
  • Our call on the record, with its due date

The verdict, the opening and every receipt above stay free. Membership adds our analysis to the evidence file for every checked story.

First membership: 30 days free, then A$89 a year. One introductory trial per customer. Card required; renews annually until cancelled. Cancel before the trial ends to avoid the first charge.