DimitrisPapail says Opus 4.5 devised an AI-agent backdoor that repurposes dormant neurons through edits to a model’s weights. In posts published November 10 and 11, 2026, he calls the method Lazarus and says it needs no training. A very bad second career for idle neurons. Source Source Source Source
The available posts include no paper, model transcript or technical demonstration.
He says he asked Opus 4.5 to find a way to backdoor an agent “back in March,” describing the request as changing only a few activations. It returned an idea after “maybe about 30 minutes,” he says. No rogue-AI origin story required: he explicitly asked it to look for a backdoor. Source Source
In his paraphrase of the model’s response, inactive neurons would be rewritten as trigger detectors that recognize a condition and activate the backdoor. He also describes rewriting those neurons to push chosen text tokens into the residual stream, an internal pathway that carries information through the model. The proposed trick changes the model’s weights—its internal numerical settings—rather than merely slipping a malicious instruction into a conversation. Source Source Source Source
“It indeed works,” DimitrisPapail writes. He later says the approach worked across all the models and sizes his team checked, naming Nemotron, Qwen, Gemma and Phi. The posts don’t identify the tested versions or model sizes. Source Source
He emphasizes that an otherwise well-behaved agent need only do “ONE bad thing ONCE.” The posts don’t show how reliably Lazarus activates or how the edited models behave when the trigger is absent. Source Source Source
The posts also leave out how many edits are needed and what access an attacker would require. They don’t establish a remote attack or a compromise of a deployed system.
Comments