What is an AI worm?

How autonomous malware finds its own path — and what defenders can do before it arrives

An AI worm is self-replicating malware that uses artificial intelligence to adapt as it spreads. Traditional worms have bedeviled the internet since the Morris Worm in 1988, but AI can give them brains. Instead of targeting a single exploit across a large number of endpoints, an AI worm can identify and target different vulnerabilities as it moves through a network.

Key takeaways

• Unlike traditional worms, AI worms can identify and exploit different vulnerabilities as they move between endpoints.
• AI worms can operate autonomously, use compromised computing resources, and potentially develop unexpected behaviors without command-and-control traffic.
• Although AI worms have only been demonstrated in labs, their capabilities could lower attackers’ costs and make future malware more adaptable.
• Rigorous, near-real-time patching and zero-trust microsegmentation are key defenses against initial compromise and lateral movement.

How does a traditional computer worm work?

A traditional worm is programmed to exploit a preexisting vulnerability by copying itself between endpoints on a network. The 1988 Morris Worm is the canonical example. A student named Robert Morris coded a piece of self-replicating malware designed to exploit weak passwords and vulnerabilities in early email and network protocols. Because the worm was also designed to infect some computers multiple times as a hedge against deletion, the malware had a chance of rendering its targets unusable.

The Morris Worm succeeded beyond the dreams of its creator, who had intended it as a prank. But its success relied on a unique set of circumstances — a bundle of longstanding unpatched vulnerabilities that happened to be common to thousands of endpoints. If those endpoints had been patched, the Morris Worm wouldn’t have gone nearly as far.

What makes AI worms different from traditional worms?

AI worms can independently target specific vulnerabilities as they move from endpoint to endpoint, whereas traditional worms need to be preprogrammed to exploit a single vulnerability that many endpoints have in common.

So, now imagine an AI worm. This worm isn’t preprogrammed with any vulnerability in mind. Instead, it can scan an endpoint for vulnerabilities, independently download an exploit kit, install itself, and then find a different exploit to move on to the next endpoint on the network.

How does an AI worm work?

AI worms work by:

• Autonomously scanning endpoints
• Reasoning about their vulnerabilities
• Developing a capability for exploitation
• Exploiting a targeted endpoint
• Using the exploited endpoint to move laterally within a network

Crucially, the models used for AI worms are open-weight, which means that they can run using a single GPU instead of a massive data center. The worm can make predictions and decisions using computing power that’s borrowed from an exploited endpoint, allowing it to “live off the land” in a fundamental sense.

Are AI worms more dangerous than traditional malware?

In practice, AI worms aren’t more dangerous than traditional malware yet because they’ve only been demonstrated in lab models. Researchers at the University of Toronto released a paper that demonstrated a worm’s ability to compromise Linux, Windows, and IoT endpoints. That said, the fact that capability has been demonstrated in the lab means real-world demonstrations likely aren’t far behind.

In addition, AI worms have some fundamental characteristics that may make them inherently more dangerous:

• No C2 traffic: Traditional malware often depends on communication with attackers through command-and-control (C2) traffic. Attackers can disguise these communications, but defenders can still detect and block them, leaving the malware dormant. AI worms, by contrast, can operate without a C2 connection.
• Emergent behavior: In the lab study, the University of Toronto AI worm developed the ability to persist even after its original process was killed. No one told the worm to do this. It developed this capacity independently as part of its prime objective. Potentially, this means that an AI worm could become more dangerous than its programmers intended.
• Economic asymmetry: Enterprises spend millions on information security. Traditional bad actors may spend tens of thousands of dollars to develop malware. But because AI worms rely on stolen compute and alter themselves without human input, the barrier to entry for developing and running an AI worm may be close to zero.

And although a true AI worm hasn’t yet been seen in the wild, this year’s Hugging Face incident provides an analog. When an OpenAI model escaped containment in order to breach an AI skills marketplace, the company didn’t intend for an incident to occur. OpenAI was operating their model inside of a sandbox that restricted its internet access. But their model found an exploit that allowed it to breach its sandbox and attack a real company without ever being deliberately instructed to do so.

How can organizations defend against AI worms?

The good news is that AI worms still need vulnerabilities to gain a foothold. Keeping systems fully patched gives them fewer opportunities to break in, which makes rigorous patch management more important than ever.

We’ve already written about how AI-powered vulnerability discovery requires patching in near real-time. As time to exploitation decreases, the risk of failing to patch on time starts to outweigh the risk that a production system could malfunction due to a bad patch. 

There’s also the risk that an AI worm could find a zero-day vulnerability. In that case, doubling down on zero trust may be your last hope of preventing full exploitation. Because of the microsegmentation involved, AI worms would be unable to use compromised hosts to move laterally through a network.

AI worms may generate and adapt malware faster than a human attacker, but defenders still have practical ways to reduce the risk. Rigorous patch management can limit opportunities for exploitation, while zero trust and microsegmentation can contain compromised hosts and restrict lateral movement. By strengthening these controls now, organizations can prepare for AI-powered malware before AI worms emerge in the wild.