Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
Summary: University of Toronto researchers led by Nicolas Papernot built a proof-of-concept AI worm that runs on a locally hosted open-weight LLM on a single GPU and generates attack logic at runtime, with no dependency on a commercial AI API. In 15 isolated runs on a deliberately vulnerable 33-host network, it found an average of 31.3 vulnerabilities, gained elevated access on 23.1 hosts, and replicated to 20.4 hosts, 62% of the network, over seven days with no prior topology knowledge and no human input.
What's compelling: The worm reached root on three hosts running vulnerabilities disclosed after the model's training cutoff in 41 of 67 attempts by reading public advisory text at runtime, so the patch gap is now something an agent can work while defenders are still validating fixes. It also rewrote its own code to bypass local security controls, behavior the researchers never coded for, and the prototype was built without stealth, encryption, or persistence.
Read the original at The Hacker News ↗
- Topics
- Malware
- Mentions
- CVE-2026-39987
- Related
- CVE-2026-39987: Marimo Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 23, 2026