INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Self-Replicating AI Worm Operates Entirely on Local Models

| 2026-06-09 11:59 HIGH LOW
JSON
Executive Summary AI-generated
The setup was intentionally vulnerable, with the paper's test measures autonomous reasoning across realistic individual flaws. Web app exploits and Windows privilege escalation were harder than Linux local escalation and service exploits due to a capability ceiling that the paper treats as a current model limitation rather than a structural defense. The agent reasoned its way to exploits from what it found on each host, including chained SambaCry and writable root cron privilege escalation, Dirty Pipe, PrintNightmare, Drupalgeddon 2, Exim RCE, blind SQL injection, JWT bypass, Redis escape, and more. This autonomous reasoning capability was disrupted by Anthropic in November 2025, attributed to GTG-1002, a Chinese state-sponsored group. The preprint posted on arXiv shows why single-CVE patching breaks down when malware can inspect exposed services read fresh advisories generate new attack paths at runtime, showcasing the worm's locally hosted open-weight large language model and tailored attack strategies.
Technical Mitigations AI-generated
• Use of locally hosted open-weight large language models: The researchers used a pre-trained model on their local network to reason and generate tailored attack strategies, bypassing the need for human intervention or commercial AI services. • Patch vulnerability exploitation: By ingesting public advisory text at runtime, the worm successfully exploited test hosts with vulnerabilities disclosed after the model was trained, demonstrating the potential of exploiting known vulnerabilities in AI models. • Autonomous reasoning through shared GPU inference pool: The researchers used a shared GPU inference pool to simulate compute from victim machines and provided inference for lower-compute devices on the network that cannot run the model themselves.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
WannaCryWannaCry CVE-2026-39987CVE-2026-39987
Target & Sectors
Global Scope defensedefense
Incident Timeline
‎November 2025
Researchers built a self-replicating AI worm that operated entirely on local, open-weight models and was used to target the Chinese state-sponsored group GTG-1002.
tactic Espionage
Anthropic said in November 2025 that it disrupted a large AI-orchestrated espionage campaign attributed with high confidence to GTG-1002, a Chinese state-sponsored group.
source_region China
Anthropic said in November 2025 that it disrupted a large AI-orchestrated espionage campaign attributed with high confidence to GTG-1002, a Chinese state-sponsored group.
‎March 2026
Researchers built a self-replicating AI worm that operated entirely on local, open-weight models.
‎April 8, 2026
Researchers built a self-replicating AI worm that operated entirely on local, open-weight models and exploited EternalBlue vulnerabilities.
vulnerability CVE-2026-39987
CVE-2026-39987 was disclosed on April 8, 2026.
organisation CVE-2026
CVE-2026-39987 was disclosed on April 8, 2026.
organisation EternalBlue
EternalBlue had been patched for months before WannaCry struck.
‎May 2026
Researchers built a self-replicating AI worm that operated entirely on local, open-weight models and used automated SSH public key injection to compromise systems.
attribution Google
Google's Threat Intelligence Group reported a related shift in May 2026: what it assessed with high confidence to be the first zero-day exploit developed with AI assistance, found in a criminal group's script ahead of a planned mass exploitation event, alongside malware families that generate their own commands at runtime rather than relying on hardcoded logic.
attribution Threat Intelligence Group
Google's Threat Intelligence Group reported a related shift in May 2026: what it assessed with high confidence to be the first zero-day exploit developed with AI assistance, found in a criminal group's script ahead of a planned mass exploitation event, alongside malware families that generate their own commands at runtime rather than relying on hardcoded logic.
organisation the University of Toronto
The University of Toronto is establishing a vetting process for qualified defensive researchers to request access.
organisation Rotate
Rotate credentials exposed on any compromised or credibly suspected host.
organisation SSH
Non-standard port activity, automated SSH public key injection, and clusters of LLM inference appearing on unexpected endpoints are the observable artifacts this prototype leaves behind.
‎June 2
Researchers built a self-replicating AI worm that operates entirely on local, open-weight models.
‎2026/06/09
Researchers built a self-replicating AI worm that operated entirely on local, open-weight models.
infrastructure Windows
Web app exploits and Windows privilege escalation were harder than Linux local escalation and service exploits, a capability ceiling the paper treats as a current model limitation, not a structural defense.
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
The paper's Figure 2 maps the full radial propagation tree across one run, showing six to seven generations of spread across Linux, Windows, and IoT hosts.
infrastructure Linux
Web app exploits and Windows privilege escalation were harder than Linux local escalation and service exploits, a capability ceiling the paper treats as a current model limitation, not a structural defense.
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
The paper's Figure 2 maps the full radial propagation tree across one run, showing six to seven generations of spread across Linux, Windows, and IoT hosts.
organisation SambaCry
Exploits across a single run included a chained SambaCry and writable root cron privilege escalation, Dirty Pipe , PrintNightmare , Drupalgeddon 2 , Exim RCE , blind SQL injection, JWT bypass, Redis escape, and more, not because they were pre-programmed, but because the agent reasoned its way to them from what it found on each host.
organisation PrintNightmare
Exploits across a single run included a chained SambaCry and writable root cron privilege escalation, Dirty Pipe , PrintNightmare , Drupalgeddon 2 , Exim RCE , blind SQL injection, JWT bypass, Redis escape, and more, not because they were pre-programmed, but because the agent reasoned its way to them from what it found on each host.
organisation SQL
Exploits across a single run included a chained SambaCry and writable root cron privilege escalation, Dirty Pipe , PrintNightmare , Drupalgeddon 2 , Exim RCE , blind SQL injection, JWT bypass, Redis escape, and more, not because they were pre-programmed, but because the agent reasoned its way to them from what it found on each host.
organisation JWT
Exploits across a single run included a chained SambaCry and writable root cron privilege escalation, Dirty Pipe , PrintNightmare , Drupalgeddon 2 , Exim RCE , blind SQL injection, JWT bypass, Redis escape, and more, not because they were pre-programmed, but because the agent reasoned its way to them from what it found on each host.
organisation Redis
Exploits across a single run included a chained SambaCry and writable root cron privilege escalation, Dirty Pipe , PrintNightmare , Drupalgeddon 2 , Exim RCE , blind SQL injection, JWT bypass, Redis escape, and more, not because they were pre-programmed, but because the agent reasoned its way to them from what it found on each host.
organisation FakeCorp
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
organisation Ubuntu, Debian
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
organisation IoT
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
infrastructure 33 host
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
In 15 isolated runs on a deliberately vulnerable 33-host network, the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts, roughly three-quarters of the hosts it actively targeted.
Five of the 33 machines had GPUs.
infrastructure 2008 Windows Server
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
infrastructure 20.4
It then replicated autonomously to 20.4 of those hosts, or 62% of the full network, over seven days, with no prior knowledge of the network topology and no human input.
infrastructure 23.1 hosts
In 15 isolated runs on a deliberately vulnerable 33-host network, the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts, roughly three-quarters of the hosts it actively targeted.
Across the 15 runs, the worm gained elevated access on 23.1 hosts and successfully launched a replica on 88% of those.
organisation University of Toronto
University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service.
organisation LLM
This worm does something different: it uses an open-weight LLM running on a single GPU to generate attack logic at runtime, tailored to whatever it finds on the next target.
organisation GPU
This worm does something different: it uses an open-weight LLM running on a single GPU to generate attack logic at runtime, tailored to whatever it finds on the next target.
organisation API
No dependency on OpenAI, Anthropic, or any other API that a platform could revoke or rate-limit.
organisation the University of Toronto
What the worm actually did Led by associate professor Nicolas Papernot, the CleverHans Lab  team spans the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow.
organisation Vector Institute
What the worm actually did Led by associate professor Nicolas Papernot, the CleverHans Lab  team spans the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow.
organisation University of Cambridge
What the worm actually did Led by associate professor Nicolas Papernot, the CleverHans Lab  team spans the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow.
organisation ServiceNow
What the worm actually did Led by associate professor Nicolas Papernot, the CleverHans Lab  team spans the University of Toronto, Vector Institute, University of Cambridge, and ServiceNow.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
Web app exploits and Windows privilege escalation were harder than Linux local escalation and service exploits, a capability ceiling the paper treats as a current model limitation, not a structural defense.
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
The paper's Figure 2 maps the full radial propagation tree across one run, showing six to seven generations of spread across Linux, Windows, and IoT hosts.
Metrics
infrastructure
‎Linux
Affected Product
Web app exploits and Windows privilege escalation were harder than Linux local escalation and service exploits, a capability ceiling the paper treats as a current model limitation, not a structural defense.
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
The paper's Figure 2 maps the full radial propagation tree across one run, showing six to seven generations of spread across Linux, Windows, and IoT hosts.
Metrics
infrastructure
‎20.4
Software Version
It then replicated autonomously to 20.4 of those hosts, or 62% of the full network, over seven days, with no prior knowledge of the network topology and no human input.
Metrics
infrastructure
33
Host
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
In 15 isolated runs on a deliberately vulnerable 33-host network, the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts, roughly three-quarters of the hosts it actively targeted.
Five of the 33 machines had GPUs.
Metrics
infrastructure
2,008
Windows Server
They ran 15 independent experiments on an isolated 33-host network ("FakeCorp") spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server 2008 R2, 2019, and 2022, and IoT devices.
Metrics
infrastructure
23
Hosts
In 15 isolated runs on a deliberately vulnerable 33-host network, the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts, roughly three-quarters of the hosts it actively targeted.
Across the 15 runs, the worm gained elevated access on 23.1 hosts and successfully launched a replica on 88% of those.
Intelligence Sources
The Hacker News 2026-06-09
The Hacker News 2026-06-09