Researchers Create AI-Driven Worm That Self-Replicates and Spreads to 20 Machines in 7 Days

According to monitoring by Beating, researchers from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow have developed a computer worm powered by open-weight large models. This worm scans networks, identifies vulnerabilities in target machines, generates attack strategies, and replicates itself after compromising a device to continue attacking the next machine. The team conducted 15 rounds of experiments in an isolated network of 33 virtual machines, with each round lasting seven days. On average, the worm gained administrative privileges on 23.1 machines and launched new copies on 20.4 machines, propagating continuously for up to seven generations. Unlike traditional worms that rely on predefined attack scripts, this system adapts its attack methods based on the specific conditions of each machine. It also reads publicly available vulnerability information released after model training and converts textual descriptions into actual attack steps. However, this remains a laboratory proof-of-concept: every machine in the test network was intentionally equipped with vulnerabilities, with no antivirus software or active defenses present. The main experiment also relied on a shared GPU pool, and neither the model nor the full code has been made public.