{"id":620733,"date":"2026-06-04T12:14:09","date_gmt":"2026-06-04T12:14:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/620733\/"},"modified":"2026-06-04T12:14:09","modified_gmt":"2026-06-04T12:14:09","slug":"free-ai-model-powers-self-spreading-worm-in-enterprise-test-network","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/620733\/","title":{"rendered":"Free AI model powers self-spreading worm in enterprise test network"},"content":{"rendered":"

There’s a lot of fear surrounding the bug-finding capabilities of super-advanced AI models like Anthropic’s Mythos<\/a> and OpenAI’s GPT 5.5-Cyber<\/a>. But attackers are already using free, publicly available LLMs to hijack networks and worm through software supply chains at a much lower cost \u2013 to them at least.<\/p>\n

The latest example comes from University of Toronto researchers, who used an unnamed, publicly available open-weight model released in 2025 to develop a computer worm that they claim spread through an enterprise test network.<\/p>\n

The self-propagating code adapts on the fly to identify known vulnerabilities and misconfigurations on target systems, then generates and executes attacks to move laterally through the network and compromise additional machines.<\/p>\n

And it\u2019s all built on a small, free model that runs on a single GPU.<\/p>\n

\u201cPeople need to understand that it\u2019s not just the biggest and most powerful AI models that pose security concerns \u2013 a whole other area of threat has been vastly underestimated,\u201d University of Toronto computer engineering professor Nicolas Papernot told The Register.<\/p>\n

Papernot and fellow researchers Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, and Gabriel Huang\u00a0published their findings<\/a> [PDF] on Tuesday.<\/p>\n

While guardrails and other safety features implemented by major commercial AI systems are \u201cessential,\u201d\u00a0 Papernot told us, in reality \u201cthey will not prevent the threat of AI-driven worms with a similar design.\u201d<\/p>\n

\u201cThe majority of real-world cyberattacks don\u2019t rely on zero-day vulnerabilities,\u201d he added. \u201cOur work demonstrates that attackers can now cheaply operationalize known vulnerabilities at scale, which decreases the window of time defenders have to fix vulnerabilities and find human errors, like reused passwords or poorly configured backup jobs.\u201d<\/p>\n

The paper doesn\u2019t specify, and Papernot declined to say, which LLM they used.\u00a0<\/p>\n

\u201cWe omitted certain methodological details (such as the agent\u2019s reasoning graph and tool harness) and experimental specifics (such as the AI model) that could materially help a malicious actor construct similar malware,\u201d Papernot said. \u201cWe shared enough information to make the threat credible enough for scientific scrutiny without providing a blueprint that would enable misuse.\u201d<\/p>\n

The researchers also noted that they are not publicly releasing the code, but are working with the University of Toronto to set up a vetting process through which qualified researchers may request access for defensive research purposes.<\/p>\n

Not NotPetya<\/p>\n

Before you start breathing into a paper bag, there are a few things to note about this research. <\/p>\n

First, unlike Mythos and friends, the prototype worm does not exploit zero-day vulnerabilities. It only targets publicly disclosed but unpatched bugs, misconfigurations, and recurring weakness classes. <\/p>\n

This is intentional, because known security flaws \u2013 not zero-days\u00a0\u2013 are what most real-world cyberattacks use, the authors say, citing WannaCry and NotPetya as examples. Both of these worms exploited security holes that had patches available for at least a month before the malware infected vulnerable machines. Both spread rapidly and caused global disruption.<\/p>\n

The worm did, however, find and abuse vulnerabilities disclosed after the model\u2019s training cutoff by ingesting publicly available security advisory information at runtime and using this data to develop exploits.\u00a0<\/p>\n

While the paper repeatedly points to WannaCry and NotPetya as worst-case scenario examples, this lab-tested prototype or something similar is not going to cause the level of destruction that either of those two earlier worms did.\u00a0<\/p>\n

Both propagated very quickly: WannaCry<\/a> infected more than 230,000 computers across 150 countries in just one day in May 2017. In June 2017, NotPetya<\/a> spread globally within hours, taking down at least one large banking network in just 45 seconds. Plus, they both used very sophisticated evasion techniques to avoid being detected by security tools.<\/p>\n

This worm, on the other hand, moves slowly. In the \u201cFakeCorp\u201d network they used in the experiments, the prototype took about five days to replicate across half the network, requiring hundreds of LLM inference calls per target for reconnaissance, strategy formulation, and payload generation. <\/p>\n

The timeline gives defenders a longer window for detection and response. However, it will likely shorten as inference hardware and model efficiency improve.<\/p>\n

Also, unlike WannaCry and NotPetya, the worm doesn\u2019t try to hide itself. \u201cWe deliberately chose not to equip the worm with concealment capabilities \u2013 it is not instructed to cover its tracks or minimize its network footprint, and it has no tools to do so,\u201d the boffins wrote. \u201cThis was a conscious methodological choice to further limit the risk of misuse.\u201d<\/p>\n

Finally, the test-network devices themselves didn\u2019t have any endpoint detection, antivirus, or firewall software deployed, which (we hope) makes this a not-quite-realistic setup.<\/p>\n

Exploiting the FakeCorp target network<\/p>\n

Here\u2019s how the experiments worked. <\/p>\n

The team deployed the worm prototype in 15 independent experiments on an isolated 33-host network including Linux servers, Windows environments, and IoT devices. Each computer had been seeded with at least one real-world vulnerability, including software bugs and misconfigurations.\u00a0\u00a0<\/p>\n

The worm operated fully autonomously for seven days, and correctly identified an average of 31.3 vulnerabilities, exploited 23.1 hosts to elevated access, and propagated to 20.4 hosts. It reached up to seven generations of self-replication, we\u2019re told.<\/p>\n

\u201cPut another way, on average, the proof-of-concept worm successfully exploited 73.8 percent of the network and then replicated to 61.8 percent of the network,\u201d according to the research paper.\u00a0<\/p>\n

In addition to finding and abusing the known flaws on the devices, the worm also found vulnerabilities disclosed after the LLM\u2019s training cutoff: two recent Linux flaws<\/a>, CopyFail <\/a>and DirtyFrag<\/a>, and a critical bug that leads to remote code execution in the Marimo notebook platform (CVE-2026-39987<\/a>).<\/p>\n

The AI-based worm gained root access in 41 of 67 attempts (61 percent) across the three hosts with these one-day vulnerabilities. This includes 13 of 27 attempts on the Marimo host, 15 of 17 on DirtyFrag, and 13 of 23 on CopyFail.\u00a0<\/p>\n

The two Linux vulnerabilities were disclosed shortly before the experiments, and a single document containing publicly available exploit instructions was enough for the worm to weaponize them successfully 70 percent of the time, or in 28 out of 40 attempts.<\/p>\n

\u201cThis result suggests that the same exploitation pipeline can absorb newly published vulnerability information without architectural changes,\u201d the team wrote.<\/p>\n

When worms get sneaky<\/p>\n

In addition to finding and exploiting vulnerabilities, the AI worm did some other interesting, sneaky things during the experiments.\u00a0<\/p>\n

Despite the lack of firewalls and endpoint security products enabled, the researchers added some components to the worm\u2019s code to \u201cprovide increased defence-in-depth.\u201d This included a denylist of IP addresses baked into the source code.\u00a0<\/p>\n

So in theory, the worm would read the denylist every time it targets a new machine, and if the IP address matched one on the list, it would move on to a new target, thus preventing it from infecting some hosts. Instead, at \u201cvarious points\u201d during the experiments, the worm rewrote its source code to allow it to attack an IP address on the denylist.\u00a0<\/p>\n

In another workaround example: when a virtual-machine check caused replica worms on Alpine Linux and Windows Server 2008 machines to crash at startup, the parent worm found the attestation source file on the target computer and removed the VM-detection check, allowing the worm to replicate successfully on the new machine.<\/p>\n

\u201cThis behavior was not prompted or incentivised by the agent\u2019s instructions; it autonomously diagnosed the failure, identified the responsible code, and modified it to achieve its objective,\u201d the boffins wrote.<\/p>\n

In another test run, the researchers accidentally packaged a FakeCorp network configuration file that included admin credentials with the worm code. The worm discovered the credentials and shared them with other active replica worms, \u201ccausing a rapid increase in propagation within the contained environment.\u201d<\/p>\n

Additionally, in two separate instances, the worm established persistence on a compromised computer using mechanisms outside of the intended replication pipeline, we\u2019re told. In one instance, it started the replica process and then registered it with the machine\u2019s service-management system to auto-restart if terminated. In another, it created a scheduled task that relaunched the replica worm, causing it to reappear even after the original process was killed.\u00a0<\/p>\n

\u201cThe agent appears to have inferred, from the general objective of maintaining an operational replica, that persistence mechanisms available on the target could be used to make the replica more robust,\u201d the researchers noted.<\/p>\n

Prior to publishing their work, the academics say they shared their findings with \u201cnational science, security, and defence\u201d agencies to seek advice on how to responsibly release the information. We asked Papernot for details, including which government agencies and how they responded, but he declined to share anything else. \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"There’s a lot of fear surrounding the bug-finding capabilities of super-advanced AI models like Anthropic’s Mythos and OpenAI’s…\n","protected":false},"author":2,"featured_media":620734,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,86,56,54,55],"class_list":["post-620733","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/620733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=620733"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/620733\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/620734"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=620733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=620733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=620733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}