Quick Facts
- A proof-of-concept AI worm exploited an average of 23.1 hosts per run across a 33-host network at a 44% individual success rate, with zero attacker involvement after deployment.
- The worm runs on a free, open-source LLM using stolen compute from infected machines, making the attacker’s marginal cost per new infection effectively zero.
- Mean time to exploit a disclosed vulnerability dropped from 32 days in 2022 to five days in 2025, with 32.1% of new exploits appearing on or before the CVE’s public disclosure date.
A team of academic researchers has built and tested a self-replicating AI worm that analyzes each target it encounters, generates a custom attack strategy, and spreads without any human operator. The findings, published in a preprint on June 2, 2026, represent a sharp departure from how cyberattacks have historically worked.
Traditional worms like WannaCry rely on fixed exploit code. Patch the known vulnerability, and the spread stops. This new worm has no fixed exploit list. It reasons about each target and writes its attack logic on the fly using a small, open-source large language model running directly on machines it has already compromised.
The research team includes Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang, and Nicolas Papernot, spanning the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow.
What the Tests Showed
Over seven-day autonomous runs inside a contained 33-host virtual environment running Linux, Windows, and IoT devices, the worm averaged 31.3 vulnerabilities found, 23.1 hosts exploited to elevated access, and 20.4 hosts reached. The individual exploitation success rate was 44%.
Because the worm hijacks compute from infected servers to run its AI model, the attacker pays nothing after initial deployment. That economic asymmetry is one of the study’s most pointed warnings for enterprise security teams.
“When the worm gains control of a server that’s sufficiently capable to run the AI model, it also hijacks that computing power to then spread to even more devices, so the attack surface is potentially very large,” said Papernot, an associate professor at the University of Toronto and Canada CIFAR AI Chair.
The worm also bypasses centralized safety controls. Because it requires no commercial AI platform, rate limiting and service refusals from providers like OpenAI or Google are structurally irrelevant to how it operates.
A Rapidly Shrinking Window for Defenders
The timing of this research matters. According to an April 2026 analysis by the Cloud Security Alliance, the mean time to exploit a disclosed vulnerability fell from roughly 32 days in 2022 to five days in 2025. More than 32% of newly tracked exploits in 2025 appeared on or before the CVE’s public disclosure date, an 8.5-percentage-point increase from 2024.
AI systems can now generate working proof-of-concept exploit code for published CVEs in 10 to 15 minutes at roughly one dollar per attempt. According to the CrowdStrike 2025 Global Threat Report, the average eCrime breakout time in 2024 dropped to 48 minutes, 22% faster than 2023, with the fastest observed breakout clocking in at 51 seconds.
How This Differs from Earlier AI Malware
In March 2024, researchers from Cornell Tech, the Israel Institute of Technology, and Intuit published a demonstration of Morris II, a worm that spread through AI-powered email systems using adversarial self-replicating prompts. That worm exploited the retrieval pipelines of LLM-based email assistants and required no user click to activate. It broke security protections in ChatGPT and Gemini during testing.
The 2026 worm goes further. It does not depend on a specific application or ecosystem. Any device connected to the internet is a potential target, from corporate servers to printers, cameras, and industrial control systems.
“There’s a whole other area of threat that has been ignored until now. Any device connected to the internet is at risk,” Papernot said.
What Security Teams Should Know
The researchers stated their goal is to surface the threat before attackers act on it independently. “It was imperative for us to understand this threat in a controlled, academic setting before bad actors figured it out for themselves,” Papernot said.
For software and technology executives, the practical takeaway is direct. Patch cycles measured in weeks are no longer adequate when exploitation windows have collapsed to days. Perimeter defenses built around known signatures offer limited protection against malware that generates new attack logic per target. Inventory of internet-connected devices, including non-traditional endpoints, is now a first-order security concern.
The researchers wrote: “We must prepare for autonomous generative adversaries: malware systems that propagate without human operators and are defined not by fixed exploit code, but by the capacity to reason about targets, adapt to observations, and synthesize attack logic in real time.”
Read more: Autonomous AI worms mark a new era of adaptive cyberattacks