Worms, But Make Them Agentic

Good morning, security frontrunners

In this week’s cyber AI breakdown, we take a look at agentic worms to learn:

DEEP-DIVE

Adaptive AI worms are moving from “spicy conference hypothetical” to “very serious enterprise threat model.”

Researchers from the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow recently built a proof-of-concept AI-driven worm inside a contained lab.

It used an AI agent to inspect each new environment, reason through available weaknesses, adapt its attack path, and replicate across Linux, Windows, and IoT systems.

Translation: the worm has memory, tools, and a to-do list.

Classic worms were already brutal.

But adaptive AI worms add a nastier twist: they do not need every victim to share the same bug.

Old worms asked:

AI worms ask:

The proof-of-concept showed three things at once.

First, an AI worm can be adaptive. Instead of carrying fixed exploitation code, it can reason through vulns, misconfigs, reused credentials etc.

So, instead of one giant prompt saying “go hack the network,” the agent used a reasoning graph made of specialised LLM calls. Each node had a narrow job.

Plan, Judge, Action, Summary, Progress.

The researchers also split its lifecycle into eight operational phases:

Second, it can be self-sustaining. The worm can use compromised machines as part of its own infrastructure, effectively stealing compute to keep reasoning and spreading.

When it compromised a GPU-equipped host, it could deploy a local copy of the LLM there and create a new reasoning node. It would also use lower-compute machines to forwarding reasoning requests “upstream” to GPU-equipped infected hosts.

Third, it does not require the fanciest frontier model. The researchers used smaller open-weight models that can run locally.

To deal with the ‘Goldfish Brain’ of the smaller model, the researchers used a hierarchical memory system.

It had three tiers:

It also did not “already know” every vulnerability in its model weights, it instead would ingest fresh advisory information at runtime based on suspected exploit paths it was facing.

For those that are diagramatically-inclined:

In testing, the agent correctly identified vulnerabilities in 82% of attempts.

Exploitation succeeded in 44% of cases.

In one representative run, it spread from one initial machine to 27 hosts across five generations of self-replication.

It reached half the network in about five days.

That is slower than classic fixed-exploit worms, so this is not yet a Slammer-speed disaster cannon.

The deeper concern is adaptability.

A worm that can reason, retry, and choose different attack paths does not need a perfect exploit.

It just needs enough weak links connected in the right order.

Example of autonomous propagation over a 7-day period:

There is no public evidence that adaptive, agentic AI worms are spreading in the wild today.

The prototype was tested in a contained virtual network, was not released publicly, and the authors withheld details that could help malicious actors reproduce it.

Also, the test environment was favorable to the worm.

Every target had at least one exploitable vulnerability, and there was no endpoint detection, antivirus, or active firewall software deployed.

So no, this does not prove that today’s AI worms would casually stroll through a hardened enterprise.

But the warning still lands.

Researchers did not rely on zero-days.

The prototype targeted publicly disclosed but unpatched vulns and misconfigs.

The answer is not just “patch faster” yelled into Teams with more punctuation.

Patching matters. Obviously.

Patch like your bonus depends on it.

But adaptive worms attack the gap between discovery and remediation.

So the defensive model has to shift from pure patch management to preemptive exposure management.

The new operating model:

That order matters.

Once an adaptive worm gets a foothold, it is not just exploiting one vulnerability.

It is asking:

The worm does not need your whole network to be weak.

It just needs a path.

Okay, so what exactly should you do to stop an agentic worm from wreaking havoc?

Well, you’re probably already doing a lot of it like, treating developers like high-value infrastructure, eliminating your priv sprawl and starting to focus on exposure over raw vulnerabilities.

However, the two big focuses should be on

For further reading: “AI Agents Enable Adaptive Computer Worms”