Researchers at the University of Toronto, the University of Cambridge and the Vector Institute developed an experimental, AI‑driven computer worm and published their findings as a preprint. The team deployed the worm inside a sealed, isolated test network made up of Linux, Windows and IoT devices; the environment intentionally included common enterprise weaknesses, such as reused passwords.
The experiment aimed to show that publicly available AI models can be used today to build malicious software that learns and adapts dynamically to different targets. According to the researchers, this approach differs fundamentally from traditional worms, which typically exploit a single vulnerability.
How the worm operated
The proof‑of‑concept worm inspected every newly compromised device individually: it identified whether the target was running Linux, Windows or an IoT operating environment, mapped available weak points, analyzed them in real time, and then generated and executed an attack tailored to that specific machine. The team reported that the worm did not rely on cloud services or expensive external AI resources; instead, it ran open‑source large language models locally on infected machines and used those machines’ compute power for further propagation.
Because the worm harnessed the resources of compromised hosts, its spread incurred no additional external compute cost: as infections increased, so did the network’s aggregate "brainpower," which the researchers described as an asymmetric economic advantage.
Performance and spread
The AI‑assisted worm spread more slowly than conventional single‑exploit worms because it performed detailed analysis at each propagation step. In the test network, it took roughly five days to infect about half of the devices. The researchers warn that this time could shrink as devices and models become better at detecting vulnerabilities and drawing conclusions.
Why this is a new type of threat
Traditional antivirus and detection systems often look for known code patterns or characteristic attack signatures. The worm demonstrated in the study creates unique strategies for each target, reducing the effectiveness of signature‑based defenses. The researchers argue the key shift is that the malicious code can "think" about the target and adapt to it, rather than following a prewritten, uniform attack script.
Ethical safeguards and publication choices
Nicolas Papernot, the study’s lead author and a professor at the University of Toronto, emphasized that the research was conducted in strictly controlled laboratory conditions. The team consulted governmental and scientific bodies beforehand to determine how to make their results available without encouraging misuse. Consequently, the preprint omits certain methodological specifics and the exact identity of the open‑source model used.
"We released enough information for the threat to be credible for scientific study without providing a recipe that would enable abuse," the researchers wrote.
The stated intention was to warn the cybersecurity community of an emerging, likely inevitable danger and to allow time to develop defensive measures, which will probably also involve AI.
Implications and next steps
The demonstration highlights the dual‑use nature of AI technologies: tools that improve automation and analysis can, if abused, become dynamic cyber threats. The researchers call for accelerated development of defensive systems, responsible publication practices and continued collaboration with governments and the security community.
The result is not a ready‑made, real‑world attack but scientific evidence that the capability exists — the immediate challenge is rapid adaptation on the defensive side and the creation of AI‑driven security solutions.
