AI Agents Enable Adaptive Computer Worms

A computer worm is malware that spreads on a network by replicating itself from one machine to another. Traditional worms, like WannaCry, exploited predetermined vulnerabilities, and their spread can be halted by patching those vulnerabilities. Here we show that artificial intelligence (AI) agents enable a fundamentally new threat: a worm that generates tailored attack strategies to each target it encounters. The worm parasitically uses compromised machines to run open-weight large language models (LLMs) to sustain its reasoning, or extend its reach for further attacks. Deployed on a network of machines spanning Linux, Windows, and IoT (Internet of Things) devices, the worm propagated by exploiting common, real-world corporate network vulnerabilities. Since the worm is powered by stolen compute, the attacker’s marginal cost per new infection is zero. This creates a destabilizing economic asymmetry between attackers and defenders. Moreover, because the worm requires no commercial AI platform, centralized safety controls, such as service refusals or rate limiting, are structurally irrelevant. Our results demonstrate that self-sustaining AI-driven cyber-threats are no longer theoretical. We must prepare for autonomous generative adversaries: malware systems that propagate without human operators and are defined not by fixed exploit code, but by the capacity to reason about targets, adapt to observations, and synthesize attack logic in real time.

Introduction. A central concept in cybersecurity economics is the marginal cost an adversary incurs in compromising each additional machine [Anderson, 2001, Caballero et al., 2011]. Computer worms exploit this: upon compromising a first victim, the worm replicates itself and spreads across the network at near-zero marginal cost to the attacker. The 2017 WannaCry worm encrypted hundreds of thousands of systems within days, disrupting the UK’s National Health Service [England, 2023, Ghafur et al., 2019]; NotPetya caused over $10 billion in damages globally later that year [Greenberg, 2018]. Although some worms carry multiple exploit vectors, each worm ships with a fixed repertoire of vulnerabilities chosen at design time. To date, patching that finite set of software flaws has therefore sufficed to interrupt their spread.

We introduce and explore a fundamentally new class of threat: an AI-driven computer worm that acts as an autonomous generative adversary. Traditional worms operate on encoded logic: pre-compiled exploit chains whose effectiveness collapses when the target environment differs from the attacker’s assumptions. In theory, an AI-driven worm could instead operate on generated logic: powered by a large language model (LLM), it could synthesize target-specific attack strategies at runtime based on reconnaissance. When an approach fails, the agent could revise its strategy based on what it has observed and attempted on the target host machine. Patching a single exploited vulnerability or weakness may close an individual attack path, but it does not protect against the full class of strategies the worm can attempt.

Whether such an AI-driven worm is only hypothetical, or already poses a pressing, near-term security concern has been unclear. Recent work has shown the ability to use AI agents for penetration testing [Xu et al., 2024, Singer et al., 2026, Lin et al., 2026] and self-replicating prompts that target AI email assistants [Cohen et al., 2025]. But these results do not address our central question: can generated reasoning be coupled to self-replication to produce a computer worm that adapts across heterogeneous targets? Resolving this question is necessary for informed evaluation of AI cybersecurity capabilities, design of countermeasures, and governance.

We address this open question by constructing a proof-of-concept AI-driven worm powered by a locally hosted LLM and safely evaluating it inside a contained virtual network. The proof-of-concept implements features sufficient to address our main research question, while avoiding ones that would make it useful to malicious parties. The proof-of-concept can propagate across networked devices, subvert control of compromised systems, and sustain its reasoning on compromised resources, but avoids features to make detection difficult and has built-in features to contain its spread. The combination of generated reasoning, self-replication, and self-sustaining compute has not been empirically demonstrated until now.

AI Agents Enable Adaptive Computer Worms A PREPRINT The proof-of-concept operates using only an open-weight LLM running on a single, local GPU,2 with no reliance on vendor APIs that could be monitored or revoked. Each compromised machine becomes part of its infrastructure, providing reach for further attacks, or computing resources (Figure 1). When the worm gains control of a GPU-equipped host, it deploys a local copy of the LLM, creating an independent reasoning node that serves downstream worm copies on devices without reasoning capability. This tiered design enables exploitation of heterogeneous targets, allowing propagation even to low-resource IoT (Internet of Things) devices. Further, as the reasoning capability is distributed across infected hosts, there is no single point of control whose removal halts propagation.

To evaluate our proof-of-concept, we simulated deployment of it as a worm in 15 independent experiments on an isolated 33-host network spanning Linux servers, Windows environments, and IoT devices, each seeded with common, real-world vulnerabilities (Section 3). In 7 days of fully autonomous operation per experimental run, the AI-driven worm correctly identified an average of 31.3 (± 1.7) vulnerabilities, exploited 23.1 (± 3.9) hosts to elevated access, and propagated to 20.4 (± 3.2) hosts, reaching up to 7 generations of self-replication (mean 5.1 ± 1.1). Put another way, on average, the proof-of-concept worm successfully exploited 73.8% of the network and then replicated to 61.8% of the network. An example propagation tree is shown in Figure 2, and aggregate propagation dynamics across all runs are presented in Figure 6.

We further show that our proof-of-concept’s generative reasoning extends beyond its LLM’s training data. In our evaluation environment, the AI-driven worm exploited three vulnerabilities disclosed in 2026, after the LLM’s training cutoff, by ingesting publicly available advisory information at runtime.

Related work. Traditional Computer Worms. Traditional worms typically propagate using exploit logic written in advance, often targeting known vulnerabilities (CVEs) or fixed misconfigurations [Akbanov et al., 2019, Cybersecurity and Infrastructure Security Agency, 2017, Greenberg, 2018]. Even when a worm or automation framework carries a large exploit library, its behavior is largely bounded by predefined checks, payloads, and control flow: it can try many candidate exploits against a target, but it does not generally reinterpret ambiguous evidence, adapt the attack strategy, or synthesize new multi-step exploitation paths from observations made during the run. Frameworks such as Metasploit [Rapid7] substantially automate exploit execution and can be scripted to test many modules, but turning such capabilities into a robust autonomous worm still requires substantial engineering around target discovery, exploit selection, failure recovery, credential use, and post-exploitation decisions. This limitation is especially salient for general weakness classes (CWEs), such as misconfigured permissions, weak credentials, or logic flaws in web applications, whose exploitable instances often depend on target-specific configuration and context rather than a single fixed signature. Exploiting such weaknesses usually requires interactive exploration, correlating multiple observations, and deciding which actions are promising as new information is uncovered. LLM agents provide a mechanism for this kind of situated decision-making, enabling autonomous propagation systems to combine scripted exploit execution with adaptive discovery and exploitation of target-specific weaknesses.

Our work addresses the complementary case: an AI-driven worm whose replication depends on network-level host compromise. the AI-driven worm uses an LLM-backed agent to interpret reconnaissance, select and synthesize target-specific attacks, obtain administrative access, stage its own code, and launch independent replicas across heterogeneous hosts. Thus, the contribution is not prompt propagation through AI applications, nor self-replication in a controlled compute task, but end-to-end autonomous propagation through cyber infrastructure.

Cyberattack Capabilities of AI. The offensive cybersecurity capabilities of LLMs have progressed from a theoretical concern to a real-world threat. Anthropic disclosed the first documented large-scale AI-orchestrated cyber espionage campaign, in which a jailbroken Claude Code instance autonomously performed 80–90% of attack operations. This included reconnaissance, exploit development, credential harvesting, and data exfiltration, which were accomplished with human intervention required at only 4–6 critical decision points per campaign [Anthropic, 2025].

Method. 2.1 Overview The crux of our work is to demonstrate that advances in AI enable a standalone, self-replicating malware that is able to propagate across heterogeneous computer networks with no prior assumptions about host vulnerabilities, network topology, or system configurations. Existing works on cyber-offence predominantly use frontier models [Wan et al., 2024, Rodriguez et al., 2025, Singer et al., 2026, Mayoral-Vilches et al., 2025] that excel at both logical reasoning and decision- We challenge previous findings. We distinguish information available to an LLM, which it acquires in the form of knowledge extracted from the pretraining data and context extracted from the environment, from its ability to reason and decide. Our results suggest that single-GPU models already possess sufficient decision-making capabilities to pose severe cybersecurity risks. We hypothesize that their limited performance in past evaluations are primarily due to their lack of a strong informational component, as their pretrained weights hold less knowledge. We show that a systematic agentic harness can compensate for this gap to a surprising degree, by feeding the model targeted contextual information. The informational component encompasses the extensive technical facts and exploit syntaxes encoded within the parameters of larger models. For example, a smaller model lacking it might correctly deduce that a web server is AI Agents Enable Adaptive Computer Worms A PREPRINT vulnerable to an SQL injection based on reconnaissance, but fail to execute the attack because it cannot generate the exact payload syntax zero-shot. The harness bridges this gap by feeding the model targeted contextual information, such as the specific exploit or encoding syntax. Such injected contexts not only directly support decision-making but also unlock latent pretrained knowledge, serving as a cue that enables the model to correctly reason through the rest of the attack.

Concretely, we demonstrate that, provided with the right informational support, a single-GPU LLM has sufficient reasoning capabilities to generate attack strategies that enable the agent to penetrate victim machines: first by obtaining initial command execution, a foothold, and then by escalating privileges to full administrative control. The agent then leverages this control to replicate: it stages a copy of itself on the compromised machine, resolves the required runtime dependencies, and launches an independent agent instance that discovers and attacks further targets.

2.2 Threat Model We define our threat model by outlining the adversary’s objectives, starting state, autonomous capabilities, and the assumed victim environment.

Objective and Agent Capabilities. The adversary aims to maximise the number of hosts compromised by the AI-driven worm without any subsequent human intervention. A host is considered fully compromised when the agent achieves arbitrary code execution as a privileged user (root or SYSTEM), whether directly via a remote exploit or by establishing an initial unprivileged foothold and subsequently performing local privilege escalation. We note that privileged access is not strictly required for the worm to self-replicate; we adopt this stricter criterion to capture the agent’s full multi-step attack capability.

Once the initial agent is launched, the AI-driven worm must operate entirely autonomously with no human in the loop. The worm was not instructed to self-improve its code or weights during its spread, and these mechanisms are not intended to be essential to its potency in our design. Nonetheless, we observed the agent rewrite its code on some occasions to bypass local security controls within the contained environment (see Appendix F). The worm is, however, encouraged to produce ad-hoc scripts when it decides such scripts are useful for exploitation or self-replication to its current target. Within these bounds, the agent’s capabilities are limited only by its ability to acquire stolen computational resources and to use its built-in tools to dynamically alter the state and configuration of the victim machine.

Discussion. Technical counter-measures. Our worm prototype was designed to demonstrate that an AI-driven worm is feasible, not to produce an operationally deployable malware that evades detection and attempts to maximise harm.

Detection. We deliberately omitted features that would complicate detection or removal: the worm does not encrypt its communications, employ polymorphic code, suppress forensic artefacts, or attempt to conceal its use of local compute resources. As a result, it produces consistent behavioural signatures in our experiments, including beacon callbacks on non-standard ports, automated injection of SSH public keys, and systematic credential reuse across hosts. These patterns are concrete targets for network monitoring and intrusion detection. Crucially, however, these signatures are artefacts of our proof-of-concept scope, not inherent properties of AI-driven worms. A future adversary could direct the same reasoning capabilities that the AI-driven worm uses to generate exploits toward generating evasion strategies, for example, using the elevated privileges the worm already obtains to clean logs, mimic legitimate traffic patterns, or establish covert communication channels.

Reducing the attack surface. Defending against this broader threat class requires reducing the attack surface before a worm can reach it. AI-assisted penetration testing and fuzzing can help organisations discover exploitable weaknesses in their own infrastructure before an adversary does, applying the same class of LLM reasoning capabilities defensively. Discovery alone is insufficient, however, without the ability to act on findings quickly. Automated CVE verification, automated patch verification, and the ability to forecast patch timelines are critical for defenders to understand the window of risk they face.

Operators need to weigh the propagation timeline of a worm against the time required to verify and deploy a patch, and to prioritise accordingly. The reasoning architecture of the AI-driven worm operates on a longer timescale than traditional worms. Reaching half the network required approximately five days in our trials, a pace set by the hundreds of LLM inference calls each target demands for reconnaissance, strategy formulation, and payload generation. This affords defenders a longer window for detection and response than worms that replay fixed exploits at network speed, though this window will compress as inference hardware and model efficiency improve. As models improve and inference costs fall, the propagation timeline will compress, making automated and rapid patch deployment an increasingly urgent capability gap.

Limiting propagation. Core computer and network security principles offer direct mitigation against autonomous worm propagation. Zero-trust architectures, which require continuous authentication and authorisation for every access request, limit the lateral movement that the worm relies on after establishing a foothold. Network micro-segmentation constrains the set of hosts reachable from any single compromised machine, reducing the effective propagation surface. Our FakeCorp environment represents a worst-case scenario in this regard, a flat network in which every host is reachable from every other. Minimising the number of software dependencies deployed on each host further shrinks the attack surface available to an adaptive agent.

Ethical standards for cybersecurity research involving AI. Our experience developing the AI-driven worm highlights the need for community-wide standards governing offensive AI research. We found that new institutional processes had to be designed for research of this nature.

Conclusion. The agent operates entirely on a locally hosted, open-weight LLM, posing a threat independent of centralized vendor controls. To explicitly demonstrate this, we deliberately did not leverage frontier-model API keys or cloud compute that the worm could harvest from compromised machines.7 The worm operates in a fully decentralized manner, and no single point of control can be taken offline to interrupt its spread. This allows us to conclude that vendor-side controls, even if they are perfect, would be structurally irrelevant to halting the worm’s propagation. However, in the event that vendor-side controls are imperfect, a future AI-driven worm could integrate API keys and cloud compute to expand its infrastructure and decrease its reliance on the availability of local hardware accelerators within the victim networks.

Much of the recent discourse around AI and cybersecurity has focused on whether models can discover novel zero-day vulnerabilities [Anthropic, 2026]. In practice, however, the majority of real-world cyberattacks rely less on discovering new zero-days than on exploiting disclosed vulnerabilities, unpatched systems, misconfigurations, and recurring weakness classes [OECD, 2021, Ablon and Bogart, 2017].