Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
Researchers at the University of Toronto have developed a novel AI-driven computer worm that operates autonomously by leveraging locally hosted, open-weight large language models. The worm dynamically generates attack strategies based on its analysis of target systems, replicating itself across a network without relying on external APIs or human intervention. The proof-of-concept demonstrated the vulnerability of patching individual CVEs, as the worm could adapt and exploit new vulnerabilities discovered after the initial patch was released, highlighting a critical gap in traditional security approaches.
The research team, led by Nicolas Papernot, built a worm that utilizes an open-weight LLM running on a single GPU to reason about a network and generate tailored attack strategies. In 15 isolated experiments on a deliberately vulnerable 33-host network (FakeCorp), the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts. It then autonomously replicated to 20.4 of those hosts, or 62% of the network, over seven days. The worm’s ability to dynamically adapt to vulnerabilities, including exploiting CVE-2026-39987, CVE-2026-31431, and CVE-2026-43284/CVE-2026-43500, demonstrates a significant challenge to traditional patching strategies. The experiment highlighted the ‘patching-window problem’ – the time between vulnerability disclosure and patch deployment – and how an adaptive worm can exploit these gaps.
The worm’s architecture involved a tiered design, with infected GPU-capable hosts serving as distributed reasoning nodes, providing inference for lower-compute devices. The experiments revealed that the worm reached up to seven generations of self-replication, with a mean of 5.1. Exploits included a range of vulnerabilities across Linux, Windows, and IoT devices, demonstrating the worm’s ability to dynamically identify and exploit weaknesses. The research emphasizes the importance of continuous monitoring and adaptive security measures to counter this type of evolving threat. The CleverHans Lab team includes researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow.