University of Toronto researchers demonstrate AI-powered self-replicating computer worm
Researchers at the University of Toronto and partner institutions demonstrated a proof-of-concept AI-powered computer worm that can autonomously identify vulnerabilities, adapt attack strategies, and self-replicate across networks without human control. Tested in an isolated environment, the worm replicated to approximately 62% of test systems in seven days, prompting concerns about future cybersecurity threats.
What happened
Researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow developed and tested a proof-of-concept AI-powered computer worm capable of independently identifying vulnerabilities, creating customized attack plans, and replicating itself without human assistance.
The worm was tested in 15 isolated experiments on a purposely vulnerable network of 33 hosts running Ubuntu, Debian, Rocky Linux, Alpine Linux, Windows Server, and IoT devices. The worm discovered on average 31.3 vulnerabilities, obtained elevated privileges on 23.1 systems, and successfully replicated itself to 20.4 hosts, covering approximately 62% of the network over seven days without prior knowledge of the network structure or human guidance.
The system operates using a locally hosted open-weight large language model running on a single GPU, eliminating reliance on commercial AI platforms and avoiding API restrictions or account suspensions.
Reported impact
The findings have sparked concern among cybersecurity experts about how future cyberattacks may become harder to stop as AI tools become more common and more powerful.
The research highlights that traditional patching strategies focused on individual vulnerabilities may become ineffective against malware that can dynamically analyze systems and generate attack methods in real time.
Index analysis
Unlike traditional worms designed with predefined exploits, this AI-powered worm generates tailored attack logic based on the characteristics of each target system and can adapt its strategy when encountering challenges or roadblocks.
The study has prompted cybersecurity companies to accelerate development of AI-based defense tools that can monitor network activity, detect unusual behavior, and respond faster than traditional security software, suggesting the next phase of cybersecurity could involve AI on both sides.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.