Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers demonstrated a self-replicating AI worm using local open-weight LLMs to autonomously
Researchers from University of Toronto's CleverHans Lab built a proof-of-concept AI worm that uses locally hosted open-weight language models to reason through networks, generate tailored exploits at runtime, and self-replicate without external API dependencies. In 15 isolated tests on a 33-host network, the worm identified an average of 31.3 vulnerabilities, compromised 23.1 hosts, and propagated to 20.4 hosts (62% of the network) over seven days with no prior network knowledge. The worm demonstrated the critical vulnerability of patch-based defenses by ingesting public security advisories to exploit vulnerabilities unknown to its training data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run University of Toronto?
Get an email when a new story names University of Toronto, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers demonstrated that AI worms can operate entirely on local language models, automatically discovering and exploiting vulnerabilities across networks without human intervention or external dependencies. The worm successfully compromised 62% of a test network by ingesting public security advisories to exploit previously unknown vulnerabilities, highlighting the inadequacy of traditional patch-based defenses against AI-powered threats. This represents a paradigm shift where attackers can leverage AI to autonomously reason through complex network environments and generate tailored exploits in real-time. Organizations must evolve beyond reactive patching to proactive vulnerability management and robust network isolation strategies.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-39987
- malware — AI Worm (PoC - CleverHans Lab)