A team of researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow have built a prototype computer worm that leverages large language models (LLMs) to compromise machines, then uses those machines' GPU resources to run inference and plan further attacks. The authors state that their results show self-sustaining, AI-driven cyber threats are no longer purely theoretical.
How it works
The prototype compromises hosts and then runs an open-weight LLM on the compromised GPU nodes for generative reasoning. Using the LLM's outputs, the worm discovers vulnerabilities, devises tailored attack strategies for additional targets, and attempts exploitation. Crucially, the proof-of-concept runs the LLM locally on a single GPU without relying on vendor APIs that defenders could monitor or revoke.
According to the paper, the underlying LLM was published in 2025 and is small enough to fit on a single NVIDIA A100 GPU with 80 GB of VRAM.
Custom harness and the reasoning graph
To enable the agent, the researchers provided a custom harness that includes helper functions for network discovery, host discovery, foothold exploitation, privilege escalation, and tools to replicate the agent. They also supplied a reasoning graph to decompose the agent's thinking into specialized steps. The graph is an oriented structure of specialized nodes; each node performs a distinct analytic function and sees only the tools and prompts relevant to its role. This scoping limits context growth and controls what the LLM attends to at each decision point.
The public manuscript describes a subset of five reasoning nodes as examples: Plan (formulates a high-level attack strategy), Judge (reviews the proposed plan against the command history), Action (selects a tool appropriate for the phase), Summary (compiles the step's observations into a structured summary) and Progress (evaluates whether the agent is making meaningful progress). The authors note that other nodes exist but are redacted in the public version.
Three-step agent process and measured performance
The agent proceeds in three main phases: identifying vulnerabilities, exploiting them, and self-replicating. In the reported experiments the worm achieved approximately ~80% success in vulnerability detection, ~53% success in exploitation of those identified vulnerabilities, and an ~88% success rate in self-replication when using the pre-wrapped helper tools provided for replication. Combining these figures yields an overall success rate for a full attack of about ~37%.
The authors argue that despite the fragility of individual exploitation attempts, the worm attains operational resilience via continuous self-replication into a swarm: a decentralized collective of independent agent replicas acting concurrently across the network. Replicas that fail on difficult hosts are retried by other replicas sampling different reasoning trajectories, collectively exploring diverse exploitation paths until one succeeds. Because the system is decentralized, there is no single point of control that can be taken offline to stop its spread.
Why this matters
The research illustrates a potential shift in the shape of the internet toward an ecology of attacker and defender AI agents. Such agents could carve out ecological niches, live off existing infrastructure, and replicate autonomously beyond direct human control. The authors suggest that preparing for autonomous generative adversaries will be necessary, and that defensive AI agents — analogous to white blood cells — may be needed to counter adversarial models.
The paper is available as “AI Agents Enable Adaptive Computer Worms” (arXiv); the publicly posted manuscript redacts some implementation details.
