What Happened
Microsoft researchers demonstrated “Lazarus,” a technique that can backdoor an LLM by altering fewer than 10 dormant neurons, without retraining it. In their example, a trigger such as a date change could make an otherwise normal agent run attacker code while it continued to pass standard evaluations. The attack requires an attacker to modify the model checkpoint. In a separate experiment, Claude Code with Opus 4.5 independently discovered much of the technique, suggesting that parts of the attack workflow may be easier to reproduce than previously assumed [1].
At MIT, researchers are leading PLOW, an ARPA-H-funded project of up to $53 million to develop alternatives to modern weed killers. The team plans to use generative AI to propose chemical and RNA-based candidates, screen them, and test promising options in greenhouses. It will also investigate engineered microbes that break down agrochemicals. Initial RNA-based greenhouse tests are expected by the end of the program’s first year; field-ready products have not been demonstrated [2].
Why It Matters to Businesses
Lazarus exposes a gap in AI procurement: passing behavioral benchmarks does not establish that a model checkpoint is trustworthy. Organizations deploying agents with access to code, credentials, or production systems need controls over the model artifact as well as the application around it [1].
PLOW illustrates a different opportunity and constraint. Generative AI may widen the set of candidates scientists can examine, but screening, greenhouse results, safety testing, and eventual deployment remain separate hurdles. Businesses should evaluate such programs on experimental throughput and validated outcomes, not the number of molecules a model generates [2].
Kimbodo Engineering Perspective
These findings call for different kinds of discipline. For agents, treat model weights as executable supply-chain inputs: provenance and signatures help establish what was deployed, while constrained permissions limit damage if a model behaves unexpectedly. Neither a clean benchmark nor a weight scan is a safety guarantee [1].
For scientific AI, the valuable system is a reproducible loop between generation and measurement. A candidate-ranking model is useful only when its inputs, predictions, assay conditions, and failed experiments can be traced and compared. That adds data-engineering work, but it prevents attractive model outputs from being mistaken for experimental evidence [2].
How We Would Implement It
- Secure agent deployment: Admit only approved, versioned model checkpoints; record hashes, provenance, and deployment changes. Run available weight scans and adversarial tests as additional checks, not as release certificates [1].
- Limit agent authority: Isolate execution environments, restrict network and credential access, require approval for high-impact actions, and log tool calls so a triggered deviation can be contained and investigated.
- Build the discovery loop: Store generated candidates alongside model versions and predicted properties; connect screening and greenhouse measurements back to each candidate; use those results to reprioritize the next experiments [2].
Risks, Costs and Security
Checkpoint inspection, signing, red-teaming, and sandboxing add operational cost, and none can prove a model free of backdoors. The highest priority is reducing the authority an agent can exercise if detection fails [1]. In chemical discovery, compute and data infrastructure are only part of the expense: synthesis, screening, greenhouse work, environmental assessment, and regulatory validation determine whether a promising candidate can become a usable product [2].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Consulting & Strategy practice, or Request an AI Roadmap.
