AI adaptive computer worms have moved from a security thought experiment to a controlled research demonstration, according to a June 2 preprint by six researchers including Nicolas Papernot. The work matters because it describes malware that can adjust its approach to each machine it reaches, rather than carrying one fixed bag of exploits.
The paper, posted to arXiv by Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang and Papernot, reports a proof-of-concept worm deployed on a test network spanning Linux, Windows and IoT devices. The authors say it propagated by exploiting common corporate-network vulnerabilities.
This is research, not evidence of a running outbreak. Dark Reading reported on June 5 that adaptive, agentic AI worms had not appeared in the wild at that point. A BeyondTrust security architect predicted an AI-powered worm attack could arrive within six months to a year, but that is an expert forecast, not a demonstrated timetable.
What makes an AI-adaptive worm different from a traditional worm?
A computer worm is malware that replicates from one machine to another across a network. The preprint says conventional worms rely on predetermined vulnerabilities, meaning defenders can halt a given campaign by fixing those particular flaws.
The researchers’ prototype instead used AI agents to produce attack strategies tailored to a target. After compromising a machine, it used that machine’s resources to run open-weight large language models for further reasoning and attacks. The authors describe the result as malware defined by its capacity to observe a target and generate attack logic during the campaign.
That design has an ugly operational implication. The researchers say the attacker can use stolen computing resources to pay for subsequent AI inference, reducing the attacker’s marginal cost for each additional infection to zero. And because the system does not depend on a commercial AI service, the paper argues that provider-level controls such as rate limits and refusals would not constrain it.
A separate risk in AI email assistants
The new preprint should not be confused with Morris II, an earlier demonstration of propagation through AI-enabled email systems. WIRED reported that Ben Nassi and colleagues tested Morris II in controlled environments, not against a public email assistant.
That experiment used adversarial self-replicating prompts, instructions designed to make a generative AI system emit more instructions. In one scenario, a malicious email poisoned the database accessed by an assistant using retrieval-augmented generation. When the assistant later retrieved that email to answer a user, the prompt could cause its response to include sensitive email data; a reply containing the prompt could then reach another client and continue the chain. The researchers also tested prompts embedded in images.
The two demonstrations expose different surfaces: Morris II focused on AI applications processing untrusted content, while the June preprint describes a worm adapting across heterogeneous machines. Neither establishes that an adaptive AI worm is loose on the internet. The confirmed development is narrower and serious enough: researchers say they have shown the mechanics in a test environment.
This story draws on original reporting from WIRED.
