AI worm: Malware that adapts as it spreads across the network

Researchers at the University of Toronto have demonstrated in the laboratory a worm capable of using AI models to analyze each new device, choose an attack strategy, and exploit compromised machines to continue spreading.

A traditional worm already knows the path it has to follow.

It identifies a specific vulnerability, exploits it, and attempts to replicate itself on other devices on the network.

The prototype developed by a group of researchers from the’University of Toronto change this logic.

Their AI worm It doesn't rely on a single, pre-established vulnerability. It uses open-weighted language models to analyze the device it encounters, assess available weaknesses, and build a different strategy based on the target.

The research was conducted exclusively in a digital laboratory isolated from the outside world. Therefore, it does not reveal an active malware campaign, but rather demonstrates a new potential threat class.

What is a computer worm?

A worm It is malware designed to propagate autonomously from one device to another.

Unlike many other threats, it does not necessarily require a user to continually open attachments or install programs.

Once inside the network, it looks for other vulnerable systems and tries to replicate itself.

Traditionally, this behavior is linked to a specific technique.

If the worm is programmed to exploit a certain vulnerability, patching that flaw can stop much of its propagation.

The prototype developed by Canadian researchers instead introduces a level of adaptation.

The AI worm doesn't always use the same attack

The work, published under the title AI Agents Enable Adaptive Computer Worms, shows a worm that generates specific strategies based on the device encountered.

The system can observe the new environment and look for several weak points:

• known vulnerabilities not fixed;
• incorrect configurations;
• weak credentials;
• information recovered from already compromised devices.

The worm can then change its behavior as it propagates.

If one technique doesn't work on a computer, you can try another.

If it finds a password during an infection, that same information can be used to attempt to access a subsequent device.

Malware no longer just follows a fixed script.

Start to think about the target.

PCs, servers and IoT devices can become different targets

The researchers tested the prototype on a controlled network of different systems, including Linux, Windows, and IoT devices.

This point is important because a corporate network rarely consists of only identical computers.

The following may be present:

• workstation;
• server;
• printers;
• video cameras;
• industrial devices;
• control systems;
• IoT devices.

A traditional worm might find the same vulnerability on only part of the network.

Adaptive malware can instead look for a different path for each category of device.

The malware uses the computing power of compromised machines

The research also shows another significant element.

Once inside a device, the worm can use the machine's available computing power to run the AI model needed to plan subsequent attacks.

In practice, each new compromised device can simultaneously become:

• a victim;
• a source of information;
• a computing resource;
• a starting point for the next attack.

Researchers describe this behavior as parasitic: The malware uses the resources of the infrastructure it is compromising to fund its own propagation.

This also reduces the need to continuously rely on external AI services.

Why open-weight models change the problem

The prototype does not necessarily require the most powerful commercial AI models.

Researchers show that they can also be used open-weight models, that is, models whose parameters can be downloaded and executed locally.

This has an important consequence.

Centralized controls such as:

• provider filters;
• refusal of certain requests;
• usage limits;
• account suspension;

may become less effective if the model is run directly on compromised machines.

The security issue therefore shifts from access to the model to protecting the infrastructure.

This does not mean that all computers are already vulnerable.

The demonstration should not be transformed into a general alarm.

The prototype was tested in a controlled environment and built specifically for research.

The researchers also shared their work publicly only after removing details that could have facilitated the technique's offensive use and after consulting with scientific and security institutions.

The value of the study therefore lies above all in anticipating a risk.

It shows that the combination of AI agents and autonomous malware can enable less rigid attacks that are more capable of adapting to the conditions encountered.

The defense cannot rely on a single correction

With a classic worm, a patch can close the main vulnerability exploited for propagation.

With malware that can try different paths, this approach becomes less sufficient.

Protection must cover the entire infrastructure.

An outdated device can offer a way forward.

A weak password can give you another.

A poorly presented service can become the next step.

Security is therefore becoming more and more multilevel.

Updates and credentials remain central

The fact that the attack uses artificial intelligence does not make traditional measures useless.

On the contrary.

Professor Nicolas Papernot, head of the research group, underlines the importance of:

• install updates;
• use strong passwords;
• enable multi-factor authentication;
• reduce weak configurations;
• protect every device connected to the network.

AI makes malware better at looking for opportunities.

The most effective way to limit its action remains to reduce the number of opportunities available.

What this means for your business

Research from the University of Toronto shows a possible evolution of attacks: malware that not only executes predefined instructions, but also analyzes the environment and decides autonomously how to proceed.

For an SME, this means strengthening some already fundamental practices:

• update IoT systems and devices;
• use multi-factor authentication;
• delete unnecessary accounts and services;
• segment the network when possible;
• limit user privileges;
• monitor anomalous behavior and traffic;
• actually know which devices are connected to the infrastructure.

Artificial intelligence doesn't suddenly make all existing defenses obsolete.

However, it makes it more expensive to leave many small vulnerabilities open at once.

DigiFe supports companies in IT security, from infrastructure auditing to protecting the services and devices that make up the corporate network.