'You can't patch your way out of it': Cheap AI worm can spread between devices without human guidance — but how did scientists create it?

Researchers have demonstrated that a computer worm powered by artificial intelligence (AI) can autonomously spread across a network by identifying and exploiting vulnerabilities on different devices, raising fresh concerns about how the technology could change the future of cyberattacks.

The proof-of-concept malware, developed by researchers at the University of Toronto and cybersecurity firm CleverHans, combines a locally running large language model (LLM) with an autonomous software agent that can scan networks, assess potential attack paths, and decide how to compromise new targets without human intervention. The researchers say the work shows how AI could enable malware to adapt to unfamiliar environments rather than relying on a single preprogrammed exploit.

In experiments described in a new study uploaded June 2 to the arXiv preprint server, the worm was tested against a simulated corporate network containing 33 hosts, including Linux servers, Windows workstation computers and ot...