Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers tested an AI worm that uses a local open-weight model to map networks, pick attacks, and copy itself without human help.
Intelligence analysis by GPT-5.4 Mini
The paper describes a proof-of-concept worm that does not depend on commercial AI APIs. Instead, it runs locally, reasons about each host it finds, and generates new attack steps at runtime, showing how adaptive malware can outpace single-bug patching.
Researchers made a computer worm that acts like a tiny robot scout. It looks around a network, finds weak spots, and makes copies of itself using a local brain on the machine, like a toolbox instead of calling home for help.
Analysis
What the researchers built
University of Toronto researchers tested a proof-of-concept worm that uses a locally hosted open-weight large language model to inspect a network, choose attack paths, and replicate itself without human input. The model ran on a single GPU and did not rely on any commercial AI service.
What the tests showed
The team ran 15 experiments on an isolated 33-host lab network called “FakeCorp,” which included Linux, Windows Server, and IoT systems. Across those runs, the worm found an average of 31.3 vulnerabilities, gained elevated access on 23.1 hosts, and replicated to 20.4 hosts, or 62% of the network, over seven days. It reached as many as seven generations of self-replication.
The article says the worm was not preloaded with a fixed exploit chain. Instead, it reasoned from what it found on each host and generated attack logic at runtime. The reported exploits included SambaCry chains, Dirty Pipe, PrintNightmare, Drupalgeddon 2, Exim RCE, blind SQL injection, JWT bypass, and Redis escape.
Why the patch gap matters
A key finding is that the worm could ingest public advisory text at runtime and try fresh vulnerabilities disclosed after model training. The article says it successfully attacked test hosts configured with CVE-2026-39987, CVE-2026-31431, and CVE-2026-43284 / CVE-2026-43500. That makes the problem less about one known bug and more about how quickly an adaptive attacker can turn new advisories into working attempts.
Defender takeaways
The researchers argue this is harder to contain than older worms because there is no API key to revoke and no central AI provider to shut off. The article recommends segmenting GPU-capable systems, patching internet-facing systems quickly, rotating credentials on suspected hosts, and watching for unusual SSH activity or inference workloads on endpoints. The current prototype is not stealthy, but the paper warns that a malicious version could add encryption, persistence, and log cleanup.
Key points
- Researchers tested a self-replicating worm powered by a local open-weight model, not a commercial API.
- In 15 lab runs, it spread across a 33-host network and reached 62% of the full network over seven days.
- The worm generated attacks at runtime, including against vulnerabilities disclosed after the model’s training cutoff.
- The article says the main defenses need to be network segmentation, fast patching, credential rotation, and endpoint behavior monitoring.
- The prototype was intentionally not stealthy, but the paper warns a more advanced version could be much harder to detect.
The work gives defenders a concrete example of how an AI-driven worm behaves in practice, which can help improve detection rules and network defenses. The article also says the prototype is not publicly released and that access will be vetted for qualified defensive researchers.
The same approach could make malware harder to stop because it can adjust to each new target instead of using one fixed exploit. If a future version adds stealth, persistence, and cleanup, defenders may lose the easy signals the current prototype still leaves behind.
