Changing the cybersecurity landscape as we know it, researchers from the University of Toronto, Vector Institute and University of Cambridge have built a proof of concept, AI-powered computer worm that autonomously analyzes each target, adapts its attack strategies and builds custom exploits in real time.
The AI-powered worm uses a locally hosted, open-weight large language model (LLM) to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself — all without human intervention and without touching a commercial AI service.
The University of Toronto reports that in a controlled 33 host simulation spanning Linux, Windows and Internet of Things (IoT) devices, highlighting a significant evolution in malware capabilities. By running open weight models locally on compromised machines, it bypasses centralized AI safety controls and uses stolen compute to fuel further attacks.
According to The Hacker News, the preprint was posted to arXiv on June 2 and is under peer review. It shows why single-CVE patching breaks down when malware can inspect exposed services, read fresh advisories and generate a new attack path at runtime.
Why does this worm change the cybersecurity landscape?
Unlike traditional worms that rely on fixed exploits, AI-driven worms can adapt dynamically by identifying and exploiting unpatched vulnerabilities and human misconfigurations. Researchers demonstrated that the worm could reason about flaws disclosed after its training data cutoff.
Combined with a near-zero marginal cost per infection, this adaptability gives attackers a significant economic advantage and poses a challenge to traditional cybersecurity defense models.
What does this mean for enterprises?
The emergence of such autonomous malware presents a destabilizing economic asymmetry between attackers and defenders, because the worm's propagation incurs minimal cost to the attacker while posing substantial risks to enterprise networks, according to arXiv.org from Cornell University.
The advent of adaptive AI-driven worms also signifies a paradigm shift in cybersecurity, requiring immediate action to bolster their security measures, including proactive vulnerability management, zero trust architectures, and coordinated policy action.
Quiz