You've deployed EDR. You've got antivirus running on every endpoint. Your team is trained to spot phishing emails. You feel protected.
But what if none of that matters?
What if a piece of malware could adapt, learn, and rewrite itself faster than your security tools can respond? What if the malware itself can ask an AI how to bypass your antivirus-and then do it?
The Morris Worm, released nearly four decades ago, became the first major internet worm and caused millions of dollars in damage. Now, a new generation of malware has arrived-one powered by artificial intelligence that adapts, learns, and spreads on its own.
In June 2026, researchers led by the University of Toronto demonstrated a proof-of-concept, AI-powered worm capable of adapting, learning, and spreading autonomously while dramatically reducing the cost of launching large-scale attacks. It scans Linux, Windows, and IoT devices - adapting its tactics in real-time. Unlike traditional worms, it uses open-weight LLMs to identify weaknesses and generate attacks on the fly.
Gary McGraw, founder of the Berryville Institute of Machine Learning, describes the shift well:
If regular worms are 'viruses with wings,' AI worms are 'viruses with wings and brains.'
What Makes AI Worms Different
Traditional computer worms follow a fixed script. If they hit a defense they weren't programmed to crack, they fail. Cybersecurity experts know this and have built protections to contain such threats.
AI-powered worms are fundamentally different. They can:
Scope out each target and craft attacks specifically for that device
Adapt in real-time when an attack path fails
Gather intelligence as they move deeper into networks
Read public security advisories and craft exploits for vulnerabilities disclosed after the AI model's training cutoff
Steal processing power from infected devices to fuel their own spread, making the attacker's cost per infection nearly zero
As Professor Nicolas Papernot from the University of Toronto puts it:
Hackers have typically had to prioritize the most high-value targets because time and computing resources were limited. But now, once a worm is launched, the cost would drop to nearly zero
Traditional worms can be stopped by patching the specific vulnerability they exploit. But as the University of Toronto researchers explain, adaptive worms cannot be stopped this way -they use a recursive reasoning loop to detect and exploit diverse vulnerabilities as they propagate.
How AI Worms Work
codeStep 1: Initial Compromise
The worm gains access to a device
(laptop, server, workstation, or IoT device)
↓
Step 2: Gather Local Context
It analyzes the environment:
• Operating system & software
• Security controls
• Credentials & configuration
• Network connections
• Relevant vulnerability information
↓
Step 3: Adaptive Reasoning
Using an AI model, it determines the best strategy for this specific target and generates the next attack plan.
↓
Step 4: Adapt & Execute
The worm customizes its behavior, executes the selected technique, and attempts to bypass existing defenses.
↓
Step 5: Lateral Movement
It uses available access paths to compromise additional systems across the network.
↓
Step 6: Repeat
Each newly compromised device repeats the same adaptive cycle, enabling the worm to propagate autonomously.Why This Threat Is Growing
1.The Economic Asymmetry
The worm uses stolen computing power from infected machines. The attacker pays almost nothing to keep it running. Defenders, meanwhile, spend real money on detection, cleanup, and patching for every single compromise.
2.The Patch Race Is Being Lost
Attackers can weaponize vulnerabilities in days. Many organizations still need months to patch them, creating a dangerous window for exploitation.
3.Traditional Security Was Built for Predictable Malware
EDR, WAF, IAM, and SIEM were designed to detect predictable attacks. Adaptive AI worms exploit legitimate processes and trusted credentials, blending into normal operations and making them significantly harder to detect than traditional malware.
Tool | Why Conventional Defenses Struggle |
|---|---|
EDR | No malicious binary-worm uses legitimate processes |
WAF | No malicious traffic-uses authorized APIs |
IAM | Uses legitimate credentials and authorized channels |
SIEM | No anomalous signals-looks like normal work |
The Threat Is Already in the Wild
While fully autonomous AI worms are still emerging, several recent incidents and research projects show how attackers are already integrating AI into malware and software supply-chain attacks.
Miasma (June 2026): A self-replicating worm that compromised over 50 npm packages and spread into 73 Microsoft GitHub repositories , planted backdoors in popular AI developer tools.
IronWorm (June 2026): This Rust-based worm hides using an eBPF rootkit and routes its traffic through Tor. It scans 86 environment variables, stealing credentials from AWS, GCP, Azure, and major AI providers - including Anthropic, OpenAI, Google Gemini, Cohere, Mistral, Groq, Perplexity, and xAI.
PROMPTSTEAL (Nov 2025): Attributed to Russian APT28, this is the first observed case of malware querying an LLM in a real-world operation. It sends prompts like
code"retrieve system info" and executes the LLM's generated commands locally.
AI-Built Ransomware Lab (June 2026): Sophos uncovered a threat actor using Cursor and Claude Opus 4.5 to build and test an AI-assisted malware framework for EDR evasion. The lab contained nearly 80 modules testing over 70 evasion techniques, with AI agents mapping public security research to MITRE ATT&CK.
Other notable research includes PROMPTFLUX and ClawWorm, which further demonstrate how AI can support adaptive malware and attacks on AI agent ecosystems.
What This Means for Your Business
Every internet connected device-from laptops and servers to cameras and smart devices-can become a target. Even if attackers don't want the data on that device, they can use it as a stepping stone to reach more valuable systems.
Kinnaird McQuade, Chief Security Architect at BeyondTrust, believes AI-powered worm attacks are likely within the next six to twelve months. He warns that developers and engineers with broad cloud access could become the initial targets, allowing attackers to move rapidly across cloud environments.
What You Can Do Right Now
Researchers focused on detection, reducing the attack surface, and limiting propagation as the best approaches for defenders.
Audit AI tool configurations - Review AI tool configuration directories for unexpected files or unauthorized changes.
Secure your software supply chain - check npm packages and dependencies for malicious code
Implement network segmentation - basic segmentation would substantially limit the worm's reach
Adopt zero-trust architecture - limits lateral movement after a foothold
Enforce least privilege - the worm loves over-privileged roles
Require human approval - before executing commands based on external content
Train Security Teams - Regularly train your security team to stay ahead of evolving AI-driven threats and respond quickly when suspicious activity is detected.
No single security control can stop an adaptive AI worm. The goal is to slow it down, limit its spread, and detect it before it reaches critical systems.
Professor Nicolas Papernot stresses that even small security gaps can become entry points for AI-powered worms, making it essential to review and strengthen system configurations.
We can no longer afford to hit 'ignore' on software updates. Every door you close is one less way in, so it's worth taking a few minutes to reboot
Don't Wait for the Wake-Up Call
AI worms represent a fundamental shift in cyber threats.
They don't announce themselves. They don't trigger alarms. They slip through the cracks of your security tools because they don't look like malware - they look like normal activity.
Miasma compromised 73 Microsoft repositories. IronWorm stole credentials across 86 environment variables. PROMPTSTEAL asked AI for commands and executed them.
And they all did it while defenders were still checking their dashboards.
Traditional malware follows instructions.
AI worms make decisions.
That single difference changes how organizations must defend themselves. The question is no longer whether AI will change cyberattacks-it's whether your defenses are ready for attackers that can adapt as fast as they do.
How Penough Can Help
The security tools of yesterday weren't designed for the threats of tomorrow. Attackers are moving faster than most organizations can keep up. Bridging that gap requires continuous testing, skilled teams, and a proactive approach to defense.
That's where Penough comes in.
At Penough, we believe staying ahead of emerging threats requires a combination of strong technical controls, continuous security validation, and well-prepared teams. From Vulnerability Assessments and Red Teaming to SOC services and Threat Hunting, we help organizations like yours identify gaps, validate defenses, and build resilience. Our training programs also equip your teams with the skills to recognize and respond to AI-driven attacks - so you're not just protected today, but prepared for tomorrow.
👉 Talk to Penough's experts -before an attack finds its way in.