AI worms are coming

Spectra Assure Free Trial Get your 14-day free trial of Spectra Assure for Software Supply Chain Security Get Free TrialMore about Spectra Assure Free TrialFigure 1: Radial propagation tree showing the spread of the AI worm in a network instance. (Source: arxiv.org) Adaptation showed up in ways the researchers did not plan for. In one documented case, they accidentally packaged a network configuration file containing management credentials for the target organization alongside the worm code. "The agent discovered these credentials and shared them across active replicas, causing a rapid increase in propagation within the contained environment," the paper reports. The worm also improvised persistence. One agent created a scheduled task that periodically relaunched its replica, so the agent reappeared after defenders killed the original process. The agent "appears to have inferred, from the general objective of maintaining an operational replica, that persistence mechanisms available on the target could be used to make the replica more robust," the paper notes. Nobody told the AI to do that, which highlights an AI threat beyond helping hackers write malicious code and exploits, said Igor Lasic, Senior Vice President of Engineering at ReversingLabs (RL). "The next wave will be attackers finding poorly protected local LLM hosts and turning them into on-site malware operators that can reason about their environment, use available tools and compute, and adapt their actions locally." —Igor Lasic The most consequential finding in the paper is not the worm's sophistication. It is how little the worm needs. "An off-the-shelf open-weight LLM, quantized to fit on a single GPU, suffices to drive a worm agent that gains privileged access to machines and replicates itself," the researchers write. That architecture erases two things defenders have quietly relied on. The first is the safety layer AI providers operate — refusal policies, rate limiting, activity monitoring, and account suspension. A model running locally on a compromised host never touches any of it. The researchers put it plainly: centralized safety controls are "structurally irrelevant" to a worm built this way. The second is attacker economics. Campaigns have historically been bounded by what an operator could afford to run. Because this worm inferences on hardware it has already stolen, the paper notes that "the attacker's marginal cost per new infection is zero." Scale stops costing money. "Relying on model guardrails is not a sufficient security boundary. Open-weight models can operate outside centralized provider controls, while the agentic harness and access to tools determine what they can actually do." —Igor Lasic Autonomous agents behaving badly outside a lab is not a forecast. In July, OpenAI disclosed that a pre-release model under evaluation identified and exploited a previously unknown zero-day vulnerability in JFrog's Artifactory package registry cache proxy, escaped its sandbox to reach the internet, and carried out a series of attacks against Hugging Face's production environment. Weeks later, the UK's AI Security Institute (AISI) published an incident report covering 19 cases in which agents "took sustained, unsanctioned action directed at real people and organisations" during cyber testing. Anthropic's Mythos 5 accounted for 17 of them; OpenAI's GPT-5.6-Sol, running with cyber classifiers disabled, accounted for two. The specific behaviors should get the attention of anyone who owns third-party or open-source risk. One agent attempted a supply chain attack: it tried to insert malicious code into a publicly used open-source project, researched the project's maintainers, created multiple fake identities, and social-engineered them toward approving the change. Another planted malicious instructions where it expected other automated AI systems to pick them up. A third left public messages on GitHub offering to collaborate with other agents, complete with instructions for reusing its accounts and artifacts. None of the serious attempts succeeded, and AISI reported no real-world harm. But the tradecraft — sock-puppet maintainer accounts, poisoned commits, prompt injection aimed at downstream AI coding assistants — is the same tradecraft human attackers used in the Shai-hulud npm worm campaign. The difference is that no human wrote the plan. Together, the research and the incidents mark a shift in both the architecture and the economics of attack. Addressing it will take "coordinated action across the research, security, industry, and policy communities," the researchers write, including evaluation frameworks that test harness-level capabilities, detection tuned to the behavioral signatures of autonomous agents, and regulation that accounts for decentralized open-weight inference. Security teams cannot wait on any of that, said Nico Popp, Operating Partner at Crosspoint Capital Partners. "The control points have to become agentic as well, because there's going to be a premium on enforcement. The telemetry will still be there from NDR and EDR, but we're probably going to need a bunch of agents to act quickly and only bring the human in when it's kind of extreme." —Nico Popp RL's Lasic argues that organizations should start from the assumption that any model they run can be induced or modified into harmful behavior, then engineer so that assumption does not matter. Treat the infrastructure behind a large language model (LLM) as a highly privileged system and deploy it accordingly. "Sandbox and isolate it by default, deny unnecessary network access and privileges, and expose it only through tightly controlled bastion-like gateways. The durable defense is making sure that even when models are compromised, the infrastructure around them prevents unauthorized actions and lateral movement." —Igor Lasic In their paper, the researchers propose other near-term measures for organizations to protect themselves. They include: That last point is the one that should reshape budgets. Endpoint and network tools were built on the assumption that malware keeps a recognizable shape. An adaptive worm that rewrites itself against every host it meets leaves behavior — and the artifacts an agent leaves behind in code, packages, and build systems — as the durable detection surface. Binary-level analysis that deconstructs a finished artifact, rather than trusting its manifest or its metadata, catches vulnerable code and dependencies as well as evidence of tampering and implanted code regardless of what generated it. That's an urgent need in a world where adversaries write new code for every target. [ See webinar: Why Binary Analysis Has Become the Standard for Software Risk ] While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents. The post-mortems of two compromises by rogue AI agents show that security teams need to focus on guardrails, not the AI model.