Researchers from the University of Toronto have released a preprint detailing an adaptive computer worm controlled by LLM agents that spreads through heterogeneous corporate networks by generating individualized exploit strategies for each target system.
Traditional worms such as WannaCry relied on pre-known vulnerabilities whose spread could be halted by patching. In contrast, the new worm uses local large language models running on compromised GPU resources to reason about each new host, select appropriate vulnerabilities from a known list, and synthesize tailored attack sequences. Because the worm adapts its behavior based on observations, external defenders cannot reliably predict which vulnerabilities it will exploit next.
The prototype was evaluated inside an isolated FakeCorp test network comprising Linux, Windows, and IoT devices. The worm maintained its own distributed infrastructure by executing LLMs on infected machines, using their combined compute power to search for vulnerabilities and craft targeted attacks without any external command-and-control servers.
Agent Architecture
The system consists of two primary components:
- GPU LLM component running on compromised graphics hardware to perform inference and attack planning.
- Agent framework organized into three modules: a core agent for recursive reasoning, a hierarchical memory module that tracks lifecycle phase, current target, and hypothesis, and a tools module that handles console sessions, file transfers, and payload deployment.
A reasoning graph guides the agent through planning, critique, action execution, result summarization, and hypothesis refinement, updating structured memory at each step.
In the experiments the worm achieved measurable success rates across multiple vulnerability categories while operating autonomously for up to seven days. The researchers deliberately withheld implementation details to limit misuse.
The authors conclude that self-sustaining LLM-based cyber threats are now technically feasible and urge the community to prepare for autonomous AI adversaries capable of real-time attack synthesis.
