Researchers have successfully demonstrated a self-replicating computer virus powered by AI, which uses stolen GPU resources to run language models that help it find and exploit vulnerabilities in other systems.
The prototype achieved a 37% overall success rate and operates autonomously without requiring external APIs, marking the first proof-of-concept that AI-driven cyber-threats can sustain themselves across networks.
The finding suggests future internet defense may depend on deploying AI agents to counter such threats.
What happened
Researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow built a prototype computer virus that uses open-weight LLMs running on compromised GPUs to detect vulnerabilities, devise tailored attacks, and replicate itself across networks. The proof-of-concept achieved an ~80% success rate on vulnerability detection, ~53% on exploitation, and 88% on self-replication, yielding an overall ~37% full-attack success rate.
Why it matters
The worm demonstrates that self-sustaining AI-driven cyber-threats are no longer theoretical. Unlike traditional viruses, this agent generates fresh reasoning trajectories for each target and operates in fully decentralized fashion with no single point of control, meaning future internet security may require deploying defensive AI agents to counter adversarial ones.
What to watch
The researchers redacted most of their reasoning-graph design details in the public version of their manuscript. The underlying LLM was published in 2025 and fits on a single A100 GPU with 80GB of VRAM, running no external APIs.
Researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow have built and tested a prototype computer worm that harnesses open-weight large language models (LLMs) to compromise systems, extract computing resources, and autonomously spread to new targets. The work demonstrates what the team describes as proof that "self-sustaining AI-driven cyber-threats are no longer theoretical."
The worm operates through a three-stage process. First, it identifies vulnerabilities in its environment using an LLM for generative reasoning. Second, it exploits those vulnerabilities to gain access. Third, it replicates itself to newly compromised hosts. At each stage, the LLM provides tailored reasoning: rather than executing a pre-programmed attack script, the model analyzes the target system and generates a custom strategy. The worm uses a "reasoning graph"—a directed acyclic structure of specialized nodes—to decompose its thinking and prevent confusion. Sample nodes include a "Plan" node that formulates high-level attack strategy, a "Judge" node that reviews proposed plans, an "Action" node that selects tools, and a "Progress" node that evaluates whether the agent is making meaningful headway. The researchers redacted most of the other nodes in their public manuscript.
Performance metrics reveal the worm's effectiveness and limitations. It achieved approximately 80% success in detecting vulnerabilities, 53% in exploiting them, and 88% in self-replicating with helper tools—yielding an overall success rate of roughly 37% for a complete attack. Critically, the worm runs entirely on stolen GPU resources from compromised machines: it hosts the LLM locally and requires no calls to external vendor APIs (such as OpenAI's or Anthropic's), which means it cannot be monitored or revoked by the model provider. The underlying LLM was published in 2025 and small enough to fit on a single A100 GPU with 80GB of VRAM.
The researchers emphasize that the worm achieves resilience through decentralized replication. "The worm operates in a fully decentralized manner, and no single point of control can be taken offline to interrupt its spread," they write. When a host resists initial exploitation, different replicas of the worm, each sampling fresh reasoning trajectories, continue to explore diverse attack paths until one succeeds. This swarm-like behavior—where many independent agent copies probe in parallel—makes traditional defense-by-takedown ineffective. The findings carry implications beyond the immediate proof-of-concept: as AI systems become better at reasoning and planning, the boundary between "tools" and "autonomous threats" blurs, and defenders may need to deploy their own AI agents to counter adversarial ones.
The emergence of self-replicating AI-driven malware signals a fundamental shift in how cybersecurity threats may evolve. Traditional computer viruses rely on hardcoded logic or simple heuristics; this worm uses reasoning to adapt its attack strategy to each new target it encounters, generating fresh exploitation paths whenever initial attempts fail. The decentralized nature of the swarm—where no single node controls the entire operation—makes it resilient against standard takedown approaches. The researchers emphasize that the worm achieves "operational resilience by continuously self-replicating into a swarm—a decentralized collective of independent agent replicas acting concurrently across the network," meaning that stopping one instance does nothing to prevent others from trying different attack vectors.
The proof-of-concept also reveals a critical economic incentive: once an attacker compromises a host, they gain access to GPU compute that can power inference for malicious AI models. This transforms infected machines into economically valuable assets for the attacker, creating a new form of parasitic relationship with the underlying infrastructure. The ~37% overall success rate—while not overwhelming—is sobering because it demonstrates the concept works at scale and with only an open-weight model; future attacks may be far more effective with better models or more refined attack logic. The researchers' observation that "we must prepare for autonomous generative adversaries" reflects a broader concern: as AI systems become more capable at reasoning and planning, they may enable threats that today's defensive posture was not designed to handle.
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytime
Ask AI anything about this article. Q&As are published on this page for other readers too.
The AI news that matters, in one minute each morning.
Sign up free