Researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow have shown that an AI-driven worm can choose its own attack for each machine it reaches and keep spreading without calling any commercial AI service. It ran only inside an isolated lab network. The paper, "AI Agents Enable Adaptive Computer Worms", was posted to arXiv on 2 June 2026 and has not been peer reviewed.
Update, 23 October 2026: We rechecked this article against the paper and the University of Toronto's own release. We removed two quotations and a "world's first" claim that we could not trace to any source, changed "open-source" to "open-weight", and replaced our timing claim with the figures reported from the paper. The original headline called the worm "unstoppable". The researchers do not say that, and their own results show where it can be stopped.
The worm exploits publicly known vulnerabilities and ran only in a closed test network.
READ ALSO: Anthropic Warns AI Could Soon Copy Itself Onto Cheap Smart Devices
What the team built
A classic worm carries a fixed exploit for one known flaw. This prototype carries a language model instead. On each new machine it looks around, works out what is weak, writes an attack suited to that system, and then uses the infected machine's own processor to run the model that plans the next hop. According to Toronto's engineering news release, that is why the cost of each new infection is close to zero for the attacker, and why refusals or rate limits at an AI company cannot stop it: no AI company is involved.
The lead author is Nicolas Papernot, who runs the CleverHans Lab at Toronto. Toronto's release says the tests ran in a closed simulation, and that the team briefed national science, security and defence bodies before publishing.
The numbers
The paper's abstract page gives the argument but not the figures. Secondary summaries, including AI Weekly's write-up, report these results from 15 runs on a 33-host network of Linux, Windows and IoT devices with no endpoint detection:
- An average of 31.3 vulnerabilities found per run.
- About 74 percent of hosts reached elevated access, and about 62 percent received a copy of the worm, spreading up to seven generations.
- No source we could open gives a time to spread, so we do not report one. Our earlier claim of about five days to half the network is withdrawn.
Treat these figures as reported, not verified: we have not seen the full paper's tables.
Open-weight, not open-source
The team used a freely downloadable open-weight model rather than a model from Anthropic or OpenAI. The sources do not name it, and the Toronto release describes the models as relatively small and simple. "Open-weight" is the precise term: the trained weights can be downloaded and run locally, which is the point. Reported hardware for the experiments was a single high-end data centre GPU, so a phone or ordinary laptop was not shown to be enough. Our earlier claim that smartphones become fuel for the worm goes beyond what we can source.
Why it matters, including in Nigeria
The prototype exploits publicly known weaknesses such as reused passwords and unpatched software. Papernot's advice in the release is plain: keep devices updated, use strong unique passwords and turn on multifactor authentication. For Nigerian banks, fintechs, schools and small offices that run mixed fleets of old Windows machines, unmanaged routers and cameras, that advice is the real takeaway. Delayed patching is the gap an adaptive worm would use.
The defensive side is real too. Anthropic's Project Glasswing, announced on 7 April 2026, gives a restricted group of organisations access to an unreleased model to find and fix flaws before attackers do. We later covered how that model became a political issue in [the US export order against Fable 5 and Mythos 5](/news/us-government-shuts-down-anthropic-s-most-powerful-ai).
What happens next
Papernot's lab says it is building countermeasures. Peer review will test the numbers. Expect security vendors to run the same idea against hardened networks.
How close is this to a real attack?
- Which model was used, which limits independent replication.
- How well the worm performs against networks with endpoint detection, which this test lacked.
- Whether it works on weaker hardware.
- The exact spread times and percentages, pending the paper's own tables.
- Whether any vendor or national agency issues guidance in response. None has so far.
Self-spreading AI is no longer only a theory. For now it is a lab result with an old fix: patch, rotate passwords, add a second factor.
