Cybersecurity researchers are warning that a new class of malware may soon move from research labs into real-world attacks: adaptive AI worms.
Traditional computer worms are already dangerous because they can spread automatically from one system to another. But AI-powered worms could be far more flexible. Instead of relying on one fixed exploit, they could analyze each environment, search for vulnerabilities, identify exposed secrets, write or adapt exploit code, and continue spreading across networks, cloud environments, developer systems, and software supply chains.
Researchers describe them as “viruses with wings and brains.”
The concern is not theoretical. Academic and industry researchers are already building proof-of-concept AI worms in controlled environments to understand how they might behave and how defenders can stop them before a real-world outbreak occurs.
What Is an AI Worm?
A traditional worm spreads automatically by exploiting a known vulnerability or weakness. Classic examples include SQL Slammer, MSBlast, NotPetya, and other fast-moving malware events that caused widespread disruption.
An AI worm takes that concept further.
Instead of being hardcoded to exploit one specific bug, an adaptive AI worm could use an AI model to reason about its environment. It could look for weaknesses, choose the best path forward, generate scripts, steal secrets, and modify its behavior as it moves from system to system.
In practice, an AI worm could search for:
- zero-day vulnerabilities
- known but unpatched software flaws
- exposed API keys
- cloud credentials
- over-privileged identities
- weak internal services
- vulnerable developer tools
- insecure CI/CD pipelines
- misconfigured SaaS integrations
- secrets stored in repositories or local files
This makes the threat more dynamic than traditional malware.
Why Researchers Are Building Proof-of-Concept AI Worms
Researchers at the University of Toronto, the Vector Institute, ServiceNow, and the University of Cambridge have created a proof-of-concept agentic AI worm that adapts as it spreads.
The goal is defensive research.
By building controlled examples of how adaptive AI malware might work, researchers can better understand what signals to monitor, what controls slow propagation, and where enterprise networks are most exposed.
BeyondTrust researchers are also testing AI worm capabilities for similar reasons. This type of research is sometimes compared to “gain-of-function” research in biology: risky, but intended to help prepare for a future outbreak before it happens.
The key finding is worrying: the barrier to building AI-powered malware is falling.
Small, freely available AI models may already be enough to support basic reasoning, vulnerability discovery, and environment-specific exploitation.
How AI Worms Differ From Traditional Worms
Traditional worms are often stopped by patching the vulnerability they exploit.
If a worm spreads through one specific flaw, defenders can patch that flaw, block the traffic pattern, or deploy signatures.
Adaptive AI worms are different. They may not depend on one bug. Instead, they can use a reasoning loop:
- Inspect the current system.
- Search for credentials, secrets, and reachable hosts.
- Identify vulnerabilities or misconfigurations.
- Generate or adapt exploitation logic.
- Move to another system.
- Repeat the process in the new environment.
This means patching one vulnerability may not stop the worm if it can find another path.
The worm does not need every system to be vulnerable in the same way. It only needs enough weak links to continue moving.
Developers and Engineers May Be the First Targets
Researchers expect early AI worm attacks to focus on developers and engineers.
Developer machines often have access to:
- source code repositories
- cloud accounts
- package registries
- build systems
- deployment pipelines
- SSH keys
- API tokens
- npm, PyPI, or GitHub credentials
- AI coding tools
- production or staging environments
A compromised developer workstation can become a powerful launch point. Attackers may be able to steal secrets, poison packages, compromise repositories, or pivot into cloud infrastructure.
Recent attacks such as Shai-Hulud and GlassWorm already show how software supply chain malware can steal developer credentials and spread through packages and extensions.
AI worms could make that process more autonomous and adaptive.
The Software Supply Chain Risk
Software supply chains are especially vulnerable to adaptive malware because they are highly connected.
A developer may have access to GitHub, npm, CI/CD tools, cloud environments, internal documentation, and AI assistants. A build pipeline may have tokens that allow deployments, package publishing, or infrastructure changes.
If an AI worm reaches one of these environments, it could potentially:
- steal repository tokens
- modify packages
- inject malicious workflows
- publish poisoned releases
- search for secrets in code
- compromise CI/CD runners
- abuse cloud permissions
- spread through developer dependencies
- move into customer environments
The blast radius can be much larger than one infected laptop.
A single compromised developer or package maintainer can affect thousands of downstream users.
“Viruses With Wings and Brains”
Security experts often describe traditional worms as “viruses with wings” because they can fly from system to system without human help.
AI worms add reasoning capability.
They can decide where to go next, what weakness to use, what code to generate, and how to adapt to a new host.
That does not mean they are magical or unstoppable. But it does mean defenders may face malware that behaves less like a fixed script and more like an autonomous operator.
This changes the defensive challenge.
Security teams will need to detect intent, behavior, and propagation patterns, not only known indicators.
Technical Barriers Still Exist
There are still challenges for attackers.
Running AI models locally can be noisy. Some models require significant CPU, memory, or GPU resources. A machine suddenly running an ML runtime or consuming large amounts of VRAM may stand out in monitored environments.
However, attackers do not necessarily need large frontier models on every infected host. They could use small local models, remote inference, hybrid architectures, or prebuilt reasoning loops.
They may also target systems where AI tooling is already common, such as developer workstations, cloud engineering environments, or AI research systems. In those places, unusual AI-related activity may blend in more easily.
Why Patching Alone Will Not Be Enough
Patching remains essential, but adaptive AI worms challenge traditional vulnerability management.
Most organizations already struggle with patch backlogs, legacy systems, shadow IT, exposed services, and technical debt. At the same time, businesses are building more software than ever.
An AI worm could take advantage of this reality by moving through whatever weakness is available:
- an unpatched service
- a leaked token
- an over-privileged role
- an exposed API
- an insecure CI/CD secret
- a misconfigured cloud permission
- a vulnerable internal tool
The defensive goal must be broader than patching individual CVEs. Organizations need to reduce the overall number of paths an attacker can use.
Least Privilege Becomes Critical
Researchers consistently point to least privilege as one of the most important defenses.
AI worms are most dangerous when they find identities with broad access.
Over-privileged users, shared admin accounts, long-lived tokens, and developer credentials with production access can dramatically increase the blast radius.
Organizations should review:
- developer access to production
- cloud IAM roles
- CI/CD service accounts
- GitHub and package registry tokens
- SSH key usage
- administrative privileges
- SaaS OAuth grants
- secrets stored on endpoints
- local admin rights
- access between environments
The fewer privileges a compromised identity has, the less the worm can do.
Segmentation Can Slow Propagation
The proof-of-concept research also showed that flat networks are especially vulnerable.
If every machine can talk to every other machine, a worm has more paths to spread. If systems are segmented, the worm’s movement is constrained.
Defensive measures include:
- network micro-segmentation
- zero-trust access controls
- continuous authentication
- strict service-to-service access policies
- firewall rules between internal zones
- limited access from developer machines to production
- isolated CI/CD runners
- separate admin workstations
- restricted cloud network paths
Even basic segmentation can reduce the speed and reach of propagation.
Detection and Auto-Remediation
AI worms may move faster than human responders.
That means organizations need stronger telemetry and faster automated response.
Useful signals include:
- unusual secret discovery activity
- unexpected scanning from developer machines
- sudden access to many repositories
- abnormal cloud API calls
- new processes generating scripts or exploit code
- unusual AI model execution
- unexpected package publishing
- abnormal CI/CD workflow changes
- rapid authentication attempts across systems
- access from identities outside normal patterns
- endpoint-to-endpoint propagation behavior
Auto-remediation may become necessary for high-confidence signals, such as disabling a token, isolating an endpoint, revoking a session, blocking a suspicious workflow, or quarantining a workload.
How Organizations Should Prepare
Organizations should not wait for the first major AI worm outbreak.
Recommended actions include:
- reduce over-privileged accounts
- remove unnecessary local admin rights
- rotate long-lived secrets
- scan repositories and endpoints for exposed credentials
- restrict developer access to production
- harden CI/CD pipelines
- isolate build environments
- enforce MFA and phishing-resistant authentication
- monitor cloud API behavior
- segment internal networks
- patch internet-facing systems quickly
- restrict lateral movement paths
- monitor AI tool usage in sensitive environments
- deploy endpoint and cloud telemetry
- create playbooks for rapid token revocation and endpoint isolation
The goal is to reduce both opportunities for infection and propagation paths.
Why the Basics Still Matter
Despite the futuristic nature of AI worms, many of the best defenses are familiar.
Zero trust, least privilege, segmentation, patching, secret management, monitoring, and strong identity controls all remain effective.
The difference is urgency and scale.
An adaptive AI worm may exploit multiple weaknesses faster than human defenders can manually respond. Organizations that already have strong fundamentals will be more resilient. Those with flat networks, excessive privileges, weak telemetry, and widespread secrets will be at much higher risk.
Final Thoughts
AI worms are not yet widely observed, but researchers believe they are coming soon.
The combination of autonomous reasoning, vulnerability discovery, secret hunting, and self-propagation could create a new generation of malware capable of spreading across endpoints, cloud environments, developer systems, and software supply chains.
The threat is serious because modern organizations are deeply connected. Developers, CI/CD pipelines, cloud identities, SaaS tools, and production systems often share trust relationships that attackers can abuse.
The best time to prepare is before the first major AI worm incident. Organizations should focus on reducing privileges, limiting lateral movement, improving telemetry, securing developer environments, and building rapid response capabilities.
AI worms may be “viruses with wings and brains,” but strong security fundamentals can still clip their wings.
