University of Toronto Researchers Build Prototype AI Worm That Spreads Without Human Help

A University of Toronto team built a prototype worm that spreads through networks without human intervention by exploiting known computer flaws. The worm tailors its attack to different platforms and gathers passwords and additional vulnerabilities as it moves. If one flaw is patched, it switches to another on the same machine.

How the Worm Operates The worm siphons processing power from infected devices to run its reasoning and strategy updates. Lead author Nicolas Papernot said hackers have typically had to prioritize high-value targets because time and computing resources were limited, but once a worm is launched the cost would drop to nearly zero.

The researchers conducted the work in a secure closed environment using publicly accessible AI models. The prototype can only exploit known flaws and does not discover new ones.

Anthropic recently released Mythos, a model that has identified more than 10,000 previously unknown cybersecurity risks. Cloudflare reported that Mythos helped partners find 2,000 vulnerabilities, including 400 rated high or critical. Papernot said sharing the findings is the first step in prompting researchers, industry leaders, and policymakers to take action.