Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources CYBER RISK APPLICATION SECURITY CYBERSECURITY OPERATIONS VULNERABILITIES & THREATS NEWS Adaptive, Agentic AI Worms Loom as Next Enterprise Threat AI worms, or "viruses with wings and brains," adapt to new environments, seek out vulnerabilities, and will likely strike within a year, researchers say. Robert Lemos,Contributing Writer June 5, 2026 6 Min Read A MAP OF AN AI WORM'S SPREAD. SOURCE: UNIVERSITY OF TORONTO The hunt is on to find protections against the coming generation of adaptive AI worm malware, to head off a global incident on the scale of other famous worm events, such as NotPetya, Stuxnet, MSBlast, or the SQL Slammer worm. AI adaptive worms will be autonomous agents that rapidly self-propagate by searching for zero-day bugs, known but unpatched software flaws, and unprotected secrets — and they will be able to do this across multiple environments, morphing dynamically as they go. To get ahead of this evolution, AI/machine learning (ML) security researchers at the University of Toronto, the Canadian AI incubator Vector Institute, enterprise-software firm ServiceNow, and the University of Cambridge created a proof-of-concept (PoC) agentic AI worm that spreads by adapting to each new environment, searching for vulnerabilities, and creating programs to exploit the systems. And over at cybersecurity firm BeyondTrust, researchers there are also creating and testing the capabilities of an AI worm. The goal is similar to virologists' "gain of function" research, that creates pathogens to study how to protect the world against potential pandemics. Related:Bugcrowd Launches EU Data Residency Option For Evolving Data Sovereignty Needs Agentic, adaptive AI worms haven't yet reared their heads in the wild, but Kinnaird McQuade, chief security architect at BeyondTrust, expects such an event in six months to a year, he told attendees at the fwd:cloudsec North America Conference this week. "I personally believe that an AI powered worm attack is imminent," he said. "I think it's going to target developers and engineers such as yourselves, who have broad access, and will pivot through cloud, and I think many companies will not recover." Attackers have already started combining self-propagation capabilities, which historically defines a "worm," with malicious tools to attack developers and software supply chains. In September 2025, cybersecurity firms warned that a worm, Shai-hulud, started squirming its way through Node Package Manager repositories, stealing developer credentials and secrets to infect new packages. The next month, researchers discovered the Glassworm attack, which utilizes VS Code extensions to compromise developer machines. Other malware operators have started using large language models (LLMs) to improve obfuscation during attack execution, although most attackers use LLMs to help code malware, not as a runtime capability. An Old Cyber Threat With a New AI Spin AI worms are the next step, and not necessarily a new idea. Just like the idea of the worm, AI-powered digital programs have shown up in fiction: Daniel Suarez's Daemon (2006) had an AI that spread through systems, while Daniel H. Wilson's AI in Robopocalypse (2011) escaped digital containment and then spread to devices. Related:Cyber Insurance Rates Are Dropping, but Exclusions Widen The real-world AI agents are more modest: They replace "fixed exploitation code with goal-directed reasoning that adapts to the vulnerabilities of each target in real time," the University of Toronto researchers stated on their site. The agents spread across a network by jumping from device to device, adapting to its current environment, stealing secrets and finding vulnerabilities by using the systems' own resources against them. "Traditional worms can be stopped by patching the specific vulnerability they exploit," the researchers wrote. "Our adaptive worm cannot be stopped this way: it uses a recursive reasoning loop to detect and exploit diverse vulnerabilities as it propagates." Source: "AI Agents Enable Adaptive Computer Worms," University of Toronto, et al. The worm only uses small, free AI models to drive its decision-making and reasoning capabilities, the researchers stated. The AI agent autonomously identifies vulnerabilities and sensitive information on each machine, using those weaknesses to spread. This is the evolutionary process at work, says Gary McGraw, founder of the Berryville Institute of Machine Learning (BIML). If worms were "viruses with wings," AI worms are "viruses with wings and brains," he says. Related:FBI-Flagged Phishing Kit Kali365 Expands Its Reach The problem is that despite three decades of trying to deal with software vulnerabilities, most businesses continue to use software with a significant attack surface area. Even with vulnerability-finding technologies, and the purported power of Anthropic's Mythos, there may end up being fewer vulnerabilities "per square inch" of attack surface, but there is far more software — and attack surface — out there, McGraw says. "There are two dimensions in vulnerability management," he says. "We are going to be building better software, and driving down some of our technical debt, but we're also going to be building more software than ever." A Deadline for Stronger Security For researchers, discovering the capabilities of AI worms could be critical. In August 2002, a paper by a trio of researchers, "How to 0wn the Internet in Your Spare Time," discussed using lists of vulnerable servers as a preset to speed worm propagation — a so-called "flash worm." Five months later just such a worm arrived, as the SQL Slammer worm spread across the Internet, infecting 90% of its hosts in less than 10 minutes. There are technical hurdles for any would-be attackers, however. While cryptojacking shows that attackers can hijack processors and memory without the victim necessarily noticing, an AI worm would be an order of magnitude more obvious, says August Moore of senior AI and security engineer at 7AI, an AI-cybersecurity firm. "[I]t's much easier to stay hidden on systems where no one is looking," he says, while an open-weight model running on a typical system will be much more detectable: "Tens of gigabytes resident in VRAM and an ML [machine-learning] runtime on a host with no reason to run inference won't fade easily into background noise." Yet, attackers will likely be able to improve quickly, because companies should not rely on the foundational AI models to make the creation of AI worms difficult. Currently, any search that includes terms such as "malicious AI worm" are blocked by AI models, but BeyondTrust's McQuade found many simple workarounds to that, including a meta-skill script that searched through his prompts and removed any "scary" words. Stop the Worms Before They Start Making enterprise networks resilient to AI worms will take hardening and visibility, McQuade tells Dark Reading. Least privilege is a critical approach for weathering an AI worm attack — companies should look to get more endpoint and cloud telemetry and start setting up auto-remediation actions. "It's about stopping [an attack] before it starts, and taking action immediately when you notice those signals and being able to understand that broader blast radius," he said. "The worm loved when it found over-privileged roles, human access to production environments, secret sprawl, but we have to deal with this at a scale like we haven't seen before, and the barrier to the AI powered worms is low." The University of Toronto researchers also focused on detection, reducing the attack surface, and limiting propagation as the best approaches for defenders. "Zero-trust architectures limit lateral movement after a foothold is established by requiring continuous authentication for every access request," they said in an FAQ accompanying their research. "Network micro-segmentation constrains the set of hosts reachable from any single compromised machine. Our test environment represented a worst-case flat network — even basic segmentation would substantially limit the worm's reach." About the Author Robert Lemos Contributing Writer Rob is an award-winning, veteran technology journalist of more than 30 years, reporting on global cybersecurity issues, the latest offensive and defensive technologies, malware incidents, cyber conflict, and AI's impact on software and cybersecurity. A former research engineer, Rob has written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. He has received five awards for journalism, including Best Deadline Journalism (Online) in 2003 for his coverage of the Blaster worm. Rob also analyzes data on various trends using Python and R for both his reporting and his clients. Recent reports include analyses of the shortage in cybersecurity workers, annual vulnerability trends, and annual threat reports. Rob holds degrees from Cornell University in Electrical Engineering and Computer Science (double major). Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 How Enterprises Are Harnessing Emerging Technologies in Cybersecurity Access More Research Webinars The Frontier AI Era: Why Cybersecurity Must Move at Machine Speed Build vs. Buy: The Hidden Cost of Building Your Own AI Security Stack Defending in the Shadow Era: When the CVE Feed Goes Dark Building SecOps That Make the Most of Every D