Researchers from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow have built a working proof-of-concept for a self-replicating AI worm that uses open-weight language models running on hijacked GPUs to identify vulnerabilities, tailor exploits, and spread itself further. In their tests, the worm hit an 80% success rate on vulnerability detection, 53% on actually exploiting those vulnerabilities, and 88% on self-replication — an end-to-end attack success rate of roughly 37%. The whole system runs on a single A100 GPU with 80GB of VRAM using an open-weight LLM published in 2025, with no calls to any vendor API that a provider could monitor or shut off.
The design assumes an adversary that never touches a commercial model. Once the worm compromises a machine with usable GPU capacity, it uses that stolen compute to host its own reasoning model, then points that reasoning at the next target. The authors write that AI agents enable a fundamentally new threat: a worm that generates tailored attack strategies for each target it encounters, parasitically running open-weight LLMs on compromised machines to sustain its reasoning and extend its reach. That inverts the usual assumption that autonomous AI attackers are gated by access to a hosted frontier model.
“Artificial intelligence (AI) agents enable a fundamentally new threat: a worm that generates tailored attack strategies to each target it encounters. The worm parasitically uses compromised machines to run open-weight large language models (LLMs) to sustain its reasoning, or extend its reach for further attacks”— Research team, Authors, AI Agents Enable Adaptive Computer Worms
The harness bundles helper functions for network discovery, host discovery, foothold exploitation, privilege escalation, and replication. On top of those tools sits a reasoning graph: a directed set of specialised nodes, each responsible for a distinct analytical function and each seeing only the tools and prompts relevant to its role. The authors describe five of the nodes — Plan, Judge, Action, Summary, and Progress — and redact the rest in the public version of the manuscript.
Key facts
- 01The worm hit an 80% success rate on vulnerability detection, 53% on exploitation, and 88% on self-replication, for a 37% end-to-end attack success rate.
- 02The proof-of-concept runs entirely on an open-weight LLM that fits on a single A100 GPU with 80GB of VRAM, with no vendor API dependency.
- 03Researchers came from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow.
- 04The agent uses a directed reasoning graph of specialised nodes; five of the nodes are disclosed and the others are redacted from the public manuscript.
- 05Roughly 1,337 employees from OpenAI, Anthropic, Google DeepMind, Meta, Thinking Machines, and Safe Superintelligence signed a separate statement asking the US to help pace frontier AI progress.
That graph structure is the trick that makes a mid-size open-weight model function as a persistent attacker. By decomposing the agent's reasoning into scoped steps, the graph controls what the model attends to at each decision point and prevents context from ballooning into noise. Individual exploit attempts fail often. What makes the system dangerous is that failure at the single-agent level does not stop the swarm.
The worm replicates continuously into a decentralised collective of independent agent replicas that act concurrently across the network. Difficult hosts that resist an initial attempt are retried by other replicas, each sampling a fresh reasoning trajectory. The paper frames this as operational resilience achieved despite the fragility of any single exploitation attempt — the swarm keeps sampling new strategies until one lands.
There is no command-and-control server to seize. The worm operates in a fully decentralized manner, and no single point of control can be taken offline to interrupt its spread. That is a structural break from prior malware: takedown operations traditionally target infrastructure choke points, and this design removes them.
“the worm operates in a fully decentralized manner, and no single point of control can be taken offline to interrupt its spread”— Research team, Authors, AI Agents Enable Adaptive Computer Worms
The 37% headline number cuts two ways. It is high enough that self-sustaining AI-driven cyber-threats are no longer a thought experiment. It is also low enough that the same setup functions as a public evaluation harness — a way to benchmark future open-weight model releases against a specific autonomous-attacker scenario, and to measure whether newer models make the numbers worse.
The paper lands the same week that roughly 1,337 employees from OpenAI, Anthropic, Google DeepMind, Thinking Machines, Meta, and Safe Superintelligence Inc signed a statement, covered here previously, asking the US government to support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development. The signatories argue that each company and country is under intense competitive pressure not to unilaterally slow the pace, and that the world currently lacks the tools to coordinate. Autonomous offensive-security agents are exactly the kind of downstream capability that statement is trying to price in.
The counterweight is that this is a research proof-of-concept in a controlled environment, not a worm loose on the open internet. The authors have redacted portions of the reasoning graph. The end-to-end 37% figure depends on a chain of assumptions about target composition, network reachability, and available compute on compromised hosts. Real-world defenders also run detection stacks that were not part of the test bed, and open-weight models capable of this workload are still large enough that stolen inference has a noticeable footprint on a host.
For the AI market, the useful frame is that open-weight capability and agentic tooling now compose into offensive systems that do not need any hosted API. That collapses one of the main policy levers labs have quietly relied on — the ability to monitor and revoke access to a frontier model when a customer misuses it. Defensive tooling, evaluation harnesses, and the kind of paced-frontier coordination the labs are asking for all become more valuable as the attack side gets cheaper to assemble from parts already on Hugging Face.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
