![\"Researchers](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/06\/1780624701_568_ImageResizer.ashx.jpeg\")
<\/p>\nA team of researchers at the University of Toronto in Canada has assembled a self-replicating malware – a worm – that is able to reason its way through networks, devising fresh attacks strategies for each machine it encounters rather than relying on fixed, specific exploits.<\/p>\n
<\/p>\n
What’s more, the CleverHans Lab team, led by associate professor Nicolas Papernot, used a small, free large language model (LLM) for the worm, showing it doesn’t need substantial commercial infrastructure to power it.<\/p>\n
The worm carries a copy of a single graphical processing unit (GPU) open-weight LLM that the malware runs on already compromised machines.<\/p>\n
Each newly compromised host becomes both a foothold for the malware, while providing additional compute resources.<\/p>\n
This allows the worm to parasitically sustain itself on victim infrastructure.<\/p>\n
Devices that cannot host the model themselves, such as low-resource Internet of Things (IoT) sensors, forward their reasoning queries to infected GPU-equipped nodes instead.<\/p>\n
Papernot’s team and researchers from the Vector Institute and the University of Cambridge tested the worm on an isolated, 33-host virtual environment with Linux servers, Windows machines and IoT devices [preprint<\/a>].<\/p>\n These were configured with common vulnerabilities found in corporate environments, such as re-used passwords, and unpatched software.<\/p>\n Across 15 independent seven-day runs, the worm prototype correctly identified on average 31.3 vulnerabilities per trial.<\/p>\n It was able to escalate access on 23.1 hosts, and propagated to 20.4 hosts, which amounted to nearly two-thirds of the test network.<\/p>\n Individual exploitation attempts succeeded in 44 percent of cases, with most failures caused by malformed payloads rather than a flawed attack strategy.<\/p>\n The worm performed worst against web application structures, Windows command environments, and tasks requiring precise string manipulation, which the team attributed to the code-generation ceiling of a current-generation single-GPU model rather than a fundamental design flaw.<\/p>\n That ceiling is temporary, the researchers said.<\/p>\n “These reflect the code-generation ceiling of a current-generation single-GPU model, not a fundamental constraint on the approach, and are expected to narrow as language models improve at code generation and structured output,” they wrote.<\/p>\n Despite the per-attempt failure rate, the worm’s swarm architecture compensated by running multiple parallel, independent reasoning trajectories simultaneously.<\/p>\n In the testing, the prototype successfully exploited the recent\u00a0Copy Fail<\/a>, Dirty Frag<\/a>, and a Marimo remote code execution flaw<\/a> by reading publicly available security advisories at runtime and crafting working exploits from that information alone.<\/p>\n The worm was also able to repair itself without human intervention.<\/p>\n When replicas crashed on Alpine Linux and Windows Server 2008 hosts due to a VM-detection bug, the parent worm located the attestation source file on the target machine, removed the failing check, and retried successfully,<\/p>\n AI safety controls no protection\u00a0<\/p>\n As the worm runs entirely on locally hosted open-weight models, commercial platform controls such as service refusal, content filtering, and rate limiting do not protect against this type of attack.<\/p>\n Safety guardrails on open-weight models can also be bypassed when attackers control the local execution environment, the researchers said.<\/p>\n “The traditional economic barrier in cyber security collapses,” the paper argues.<\/p>\n “The worm parasitically uses the victims’ own computational resources, reducing the attacker’s marginal cost to zero,” the researchers wrote.<\/p>\n Meanwhile, defending against the worm can be done with AI-assisted penetration testing and fuzzing to find exploitable weaknesses before adversaries do the same, along with network micro-segmentation, zero-trust architecture and looking for detectable signatures, although the latter are an artefact of the proof of concept.<\/p>\n The University of Toronto is not releasing the prototype publicly, and has established a vetting process through which qualified researchers may request access for defensive purposes.<\/p>\n Not the only AI worm<\/p>\n Prior to the CleverHans Labs research, a combined team from\u00a0Peking University, Sun Yat-sen University, Wuhan University, Tsinghua University, and Singapore Management University published ClawWorm in March this year.\u00a0<\/p>\n ClawWorm demonstrated self-replicating attacks against OpenClaw, an open-source agent framework with more than 40,000 active instances.<\/p>\n It achieves a fully autonomous infection cycle from a single message: it hijacks the victim’s core configuration to establish persistence across session restarts, executes a payload on each reboot, and propagates to every newly encountered peer without further attacker involvement.<\/p>\n “ClawWorm is the first fully autonomous, self-replicating worm targeting production-scale LLM agent ecosystems.<\/p>\n It achieves permanent persistence, executes arbitrary payloads, and autonomously spreads to new agents, highlighting severe structural vulnerabilities in current agent architectures,” the researchers wrote.<\/p>\n In their attack evaluation on a controlled testbed across four LLM backends, the researchers said they achieved a 64.5 percent aggregate success rate.<\/p>\n