Researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow have developed a prototype of an adaptive AI worm. The malware generates a unique attack strategy for each target.
The study AI Agents Enable Adaptive Computer Worms states that the experiment was conducted in an isolated virtual network. The software prototype spread across a heterogeneous network of Linux, Windows, and IoT devices through classic vulnerabilities in corporate networks.
Compromised machines were used by the worm as a computational base for further “reasoning” and spreading. The authors claim that this makes the hypothetical cost of infecting a new machine zero for the attacker.
According to developers at CleverHans Lab, the malware operated on an open language model locally, rather than through a commercial AI platform. The authors emphasize that they did not implement standard virus functions that complicate detection or removal.
The worm used a recursive cycle of “reasoning,” memory, and tools to tailor its tactics to specific devices. Infected nodes with GPUs could provide computing power for further attacks on less powerful devices in the network.
The AI exploited publicly disclosed but still available vulnerabilities, configuration errors, and recurring classes of weaknesses.
The University of Toronto described the work as the first demonstration of publicly available AI models powering a virus that changes strategy as it spreads between devices. The material also states that the research aims to help the cybersecurity community prepare for such a threat.
University professor David Lajay called the publication a “wake-up call” for developers of protective mechanisms.
Back in September 2025, the threat analysis team at startup Anthropic discovered and thwarted the first-of-its-kind cyber espionage campaign conducted by AI.