Free AI model powers self-spreading worm in enterprise test network
Toronto researchers built a self-spreading worm with a free open-weight AI model. It spread in a test network by abusing known bugs and misconfigurations, not zero-days.
Intelligence analysis by GPT-5.4 Mini
University of Toronto researchers showed that a small, publicly available AI model can drive a worm that moves through a network on its own. The prototype used runtime security advisories, targeted known weaknesses, and spread across an isolated enterprise-style testbed.
Researchers made a tiny robot helper that could move through a pretend office network by finding weak locks and open doors. It was slower than famous worms, but it still showed that even a free AI tool can help make a computer worm.
Analysis
What the researchers built
University of Toronto researchers say they used an unnamed open-weight model released in 2025 to build a worm that could move through a network without human guidance. The prototype ran on a single GPU and was tested in an isolated 33-host environment with Linux, Windows, and IoT systems.
How it worked
The worm did not rely on zero-days. Instead, it looked for publicly disclosed but unpatched bugs, recurring weakness classes, and configuration errors. The team says it could also ingest public security advisories at runtime and use that information to construct attacks against newly disclosed issues.
In 15 experiments, the worm operated for seven days, identified an average of 31.3 vulnerabilities, escalated access on 23.1 hosts, and propagated to 20.4 hosts. The authors say it reached up to seven generations of self-replication. In the “FakeCorp” test network, it took about five days to spread across half the network.
Why the authors think this matters
Professor Nicolas Papernot told The Register that the risk is not limited to the most advanced commercial AI systems. The paper’s point is that attackers can use inexpensive models to automate known-vulnerability exploitation and reduce the time defenders have to patch systems or fix human errors such as reused passwords and bad backup jobs.
The authors also say they withheld some technical details, including the specific model and parts of the tool setup, to avoid giving attackers a blueprint. They are not publicly releasing the code and are working on a vetting process for defensive researchers.
Limits of the demo
The researchers stress that this prototype is not a replay of WannaCry or NotPetya. It was slower, lacked concealment features, and was tested on a network without endpoint detection, antivirus, or firewalls. Even so, the paper treats it as evidence that AI-assisted worms are no longer a purely theoretical threat.
Key points
- University of Toronto researchers built a self-spreading worm using a free open-weight model.
- The worm targeted known vulnerabilities, misconfigurations, and weak setups rather than zero-days.
- In tests on a 33-host network, it spread across hosts and reached up to seven generations of replication.
- The authors say they withheld model and tooling details to reduce misuse risk.
- The paper argues attackers can cheaply operationalize common vulnerabilities at scale.
The slower spread gives defenders a wider window to spot unusual activity and shut it down before it reaches the whole network. The researchers also limited the release of technical details and plan controlled access for defensive research, which may reduce misuse while still helping security teams learn.
The paper suggests attackers do not need expensive frontier models or zero-days to automate dangerous worm behavior, only common weaknesses and misconfigurations. As inference gets faster and cheaper, the same approach could spread more quickly and shrink the time defenders have to react.
