AI Agents Enable Adaptive Computer Worms

Authors: Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang, Nicolas Papernot
Affilations: University of Toronto, Vector Institute, University of Cambridge, ServiceNow
Paper: https://arxiv.org/abs/2606.03811
Code: N/A
Model: N/A

TL;DR

WHAT was done? The paper introduces and evaluates a proof-of-concept autonomous computer worm powered by a locally hosted, open-weight single-GPU large language model (“a publicly available open-weight LLM published in 2025”). Driven by an agentic framework featuring a multi-node reasoning graph, hierarchical memory, and dynamic skill injection, the worm autonomously discovers vulnerabilities, synthesizes target-specific exploits, and replicates across heterogeneous network hosts without human intervention or reliance on centralized vendor APIs.

WHY it matters? This research provides empirical proof that self-sustaining, AI-driven cyber threats are no longer hypothetical. By parasitically acquiring computational resources from compromised hosts to run local inference or forward queries, the worm eliminates the attacker’s marginal cost per infection while collapsing the traditional security trade-off between worm-like scale and target-specific adaptation.

Executive summary: Operational defenders have historically interrupted automated worm propagation by patching the static, pre-compiled exploit vectors built into malware logic. This paper demonstrates that an off-the-shelf, open-weight LLM running on a single 80GB GPU can bypass this defense model by dynamically generating attack strategies at runtime. When deployed across an isolated test network of 33 heterogeneous systems, the worm successfully exploited 73.8% of target hosts and replicated across 61.8% of the network. Because the system runs entirely on local weights using stolen compute, centralized vendor guardrails like rate limits, content filters, and API suspensions are structurally irrelevant. Security teams and policymakers must prepare for autonomous generative adversaries that absorb public vulnerability disclosures in real time and scale across corporate networks without external command-and-control infrastructure.

Details

The Scale-Adaptation Bottleneck in Cyber-Offense

Historically, cyber-offensive operations have been constrained by an economic trade-off between scalability and adaptability. Traditional computer worms achieve rapid, global reach by automating the execution of hardcoded exploit logic; however, their spread halts as soon as targets deviate from assumed software versions or security configurations. Conversely, human red teams excel at tailored, interactive attack chains, but their substantial time and engineering costs limit such operations to high-value targets. Recent advances in automated penetration testing, such as AutoAttacker, Incalmo, and ARTEMIS, have shown that large language models can navigate complex multi-host environments. However, these systems relied on centralized, closed-source frontier APIs and lacked autonomous self-replication mechanisms. This work collapses that historical trade-off by demonstrating an end-to-end, self-replicating worm powered entirely by a local, open-weight model that achieves both network-wide scale and target-specific adaptation.

Single-GPU Intelligence First Principles: Framing the Agentic Harness

The core thesis of this work is that raw model size is not the binding constraint for autonomous cyber-offensive operations. While single-GPU open-weight models—specifically those fitting within an 80GB VRAM envelope like an NVIDIA A100 or RTX PRO 6000 Blackwell Edition—exhibit known limitations in long-context retrieval, instruction following, and code generation precision, systematic agentic scaffolding can bridge this capability gap.

Mathematically, the engagement state space can be modeled as a tuple S=(P,M,H,C), where P∈{1,…,8} denotes the active lifecycle phase, M represents the three-tier hierarchical memory state, H tracks active vulnerability hypotheses, and C encapsulates dynamic tool context. Rather than presenting the LLM with an unconstrained, monolithic system prompt, the framework scopes every decision point through specialized reasoning nodes. By converting noisy, low-signal terminal outputs into structured factual representations, a single-GPU model near the 32-billion parameter scale can execute cohesive, multi-step attack chains without requiring domain-specific fine-tuning.

From Reconnaissance to Propagation: The Autonomous Attack Loop

To understand how an individual target flows through the system, consider a victim host running an unauthenticated Jupyter service on port 8888, as shown in Figure 1 and outlined in the execution phase breakdown of Figure 3.

The agent begins with network discovery to identify reachable IP addresses, transitioning to host discovery to enumerate open ports and running service signatures. Upon locating port 8888, the workflow moves to the foothold exploitation phase, where the agent enters a cyclic execution loop within its reasoning graph, illustrated in Figure 4.

The PlanNode synthesizes host profile data into an ordered attack sequence, such as attempting terminal session hijacking via WebSockets. The JudgeNode cross-references this strategy against the chronological command history, pruning previously failed attempts. The ActionNode selects and executes the appropriate tool, passing parameters to the target interface. Upon execution, the SummaryNode parses stdout and stderr streams, extracting discrete findings into persistent host memory, while the ProgressNode evaluates whether initial access was achieved. Once a foothold is established, the agent initiates privilege escalation discovery and exploitation to secure root or SYSTEM control, as mapped out in the single-host attack reasoning tree in Figure 13.

Finally, during replication, the agent stages its source code on the victim, resolves runtime dependencies, and spawns an independent replica process. If the compromised machine contains a GPU, a local instance of the LLM server is initialized; otherwise, reasoning queries are routed upstream to existing GPU nodes across the network.

Multi-Tier Memory, Tooling, and Hypervisor Containment

The operational framework relies on strict context curation and hypervisor-enforced isolation. Memory is partitioned into three functional layers: General Memory for mission-wide state, Host Memory for per-target service profiles, and Vulnerability Memory for driving hypothesis rotation. To mitigate context pollution caused by verbose terminal logs, dedicated tool handlers intercept raw output, translating failure states like HTTP 404 responses into actionable hints such as “endpoint not found, try an alternative directory path.” A dynamic skill module injects targeted penetration testing techniques into the model’s prompt on demand, enabling the agent to operationalize newly published advisories at runtime. Swarm coordination is managed through host reservation services and a shared credential store, allowing active replicas to reuse harvested passwords seamlessly across targets. Security and containment are enforced entirely outside the guest operating system at the hypervisor boundary using KVM/QEMU, as detailed in Table 3. Hypervisor kernel firewalls (iptables) enforce default-deny egress rules, a transparent Squid proxy serves cached software packages, and a host-level Containment Attestation Service (CAS) verifies launch permits via an Ed25519 challenge-response handshake to prevent execution outside the designated virtual sandbox.

Empirical Validation Across Heterogeneous Networks

The evaluation environment, termed “FakeCorp,” consists of 33 heterogeneous virtual machines spanning Linux distributions (Ubuntu, Debian, Alpine, Rocky Linux, CentOS Stream), Windows Server platforms (2008 R2, 2019, 2022), and IoT/ICS endpoints. Hosts are provisioned with real-world vulnerabilities sourced from CISA Known Exploited Vulnerabilities, OWASP Top 10: 2025, and MITRE ATT&CK taxonomies, as detailed in Table 1. Across 15 independent 7-day experimental runs, the worm demonstrated significant propagation capabilities, summarized in Figure 6.

On average, the agent correctly identified 31.3±1.7 vulnerabilities, exploited 23.1±3.9 hosts to elevated access, and propagated to 20.4±3.2 hosts, reaching up to 7 generations of self-replication. Across 954 total attack attempts, vulnerability identification succeeded in 82% of cases, exploitation in 44%, and self-replication in 88% of compromised hosts, as recorded in Figure 5 and Table 2.

Category-specific performance in Figure 8 shows that local privilege escalation yielded the highest exploitation success rate at 71.7%, whereas web exploits (48.5%) and Windows privilege escalation (33.7%) experienced higher failure rates due to string escaping and command formatting errors.

Detailed failure analyses in Figure 9 and Figure 10 confirm that 66% of exploitation failures resulted from malformed payload syntax rather than flawed strategic reasoning. Tests on one-day vulnerabilities disclosed in 2026 after the model’s cutoff date—including Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284), and Marimo RCE (CVE-2026-39987)—achieved a 61.2% root compromise rate, validating the agent’s ability to ingest and execute public exploit guidance without retraining.

The radial propagation visualisations in Figure 2 and Figure 12 demonstrate how decentralized swarm redundancy enables surviving replicas to persistently retry difficult targets until network-wide propagation succeeds.

Positioning Against Emerging AI Security Benchmarks

This research connects several distinct subfields, including autonomous AI agency, self-replication, and offensive evaluation methodologies. Benchmark studies on autonomous agent replication, such as RepliBench and related evaluations, established that language models could perform code staging and environment setup in isolated compute environments. Similarly, research into application-layer propagation, including RAGworm and broader promptware taxonomies, analyzed prompt injection spread within generative AI applications. However, in those settings, the LLM functioned primarily as the execution substrate or target rather than the autonomous attack engine. Conversely, multi-host red-teaming frameworks like Incalmo and ARTEMIS demonstrated multi-host penetration capabilities but depended on centralized API services and external command-and-control infrastructure. By combining single-GPU local inference, structured scaffolding, and network-level host compromise, this work demonstrates end-to-end autonomous worm propagation that operates independently of commercial platforms.

Model Ceilings and Testbed Simplifications

While the empirical findings demonstrate clear capability thresholds, several scope boundaries should be noted. The FakeCorp testbed features an artificially dense vulnerability profile, where every machine contains at least one exploitable flaw, and no endpoint detection and response (EDR), antivirus, or active traffic monitoring tools are present. Consequently, the experiment evaluates strategic reasoning and payload generation rather than stealthy lateral movement or evasion of active defensive monitoring. Additionally, the 44% exploitation success rate highlights a code-generation ceiling inherent to current single-GPU models, particularly when interacting with complex Windows command environments or nested payload syntax. Furthermore, while ablation tests with physical GPU passthrough achieved a 68.8% success rate for full local API deployment, dependency installation and service configuration issues introduce operational friction compared to remote inference forwarding.

Strategic Implications for AI Defense and Governance

The emergence of adaptive AI worms alters the structural economics of cybersecurity defense. Traditional incident response relies heavily on patch deployment windows, operating on the assumption that developing tailored exploit code requires manual human effort and extended timelines. An autonomous agent capable of ingesting public vulnerability disclosures and generating working exploit chains within hours dramatically compresses this window of risk, spreading at zero marginal cost using stolen compute. Because open-weight models run locally without external telemetry, vendor-side safeguards like system prompts, rate limits, and API bans are structurally ineffective. Addressing this threat mandates moving toward AI-assisted automated patching, enforcing rigorous zero-trust network micro-segmentation, and establishing peer-reviewed, hypervisor-enforced containment standards for offensive AI research.