Yes. You heard it right.
An AI-enabled worm that can autonomously discover, attack, hide, adapt, and self-replicate with malicious intent can take over a computer network at almost no cost and at machine speed. From The New York Times to Hacker News to Forbes, everyone is reporting, “Scientists find way to supercharge dangerous computer ‘worms’ with AI.”
No, this is not science fiction.
Please read the original post by Nicholas Papernot, Associate Professor & Canada CIFAR AI Chair at the University of Toronto & Vector Institute.
This puts every business leadership aiming to be the next best digital and AI-powered business under additional stress.
I am wondering what a CISO is going to say when their CEO forwards this to them at 7:15 AM with a one-line email that says, “We need to talk.”
The real challenge here is not the worm in a lab. It is the conversation about to trigger in every boardroom on the planet.
Every CISO, CIO, and CDO needs to be breach ready today.
Welcome to the Age of the Thinking Worm. Autonomous. Low Cost. Devastating
Historically, a computer worm is malware that crawls through a network, copying itself onto every device it touches, with zero human intervention and without users’ knowledge. If it takes root, it can wreak havoc across an entire system. Traditionally, this type of attack follows a fixed script programmed by a human. If it hits a defense it wasn’t programmed to crack, it fails. One of the most notorious worms, WannaCry, was successfully stopped by patching vulnerabilities.
The breaking news on Gizmodo was, therefore, chilling. “A Fundamentally New Threat: Researchers Develop New AI-Powered Worm That Might Be Unstoppable.”
Unstoppable? Initially, the word seemed like hype. But here is what happened.
Researchers at the University of Toronto experimented in a secure digital lab to help the cybersecurity community prepare for an imminent threat. They succeeded in building a worm that generates tailored attack strategies for each target it encounters.
Original post and all credits to the authors at https://cleverhans.io/worm, copied here to amplify this new cybersecurity threat.
The worm parasitically uses compromised machines to run large language models (LLMs) at scale to sustain its reasoning or extend its reach for further attacks. Deployed on a network of machines spanning Linux, Windows, and IoT (Internet of Things) devices, the worm propagated by exploiting common, real-world vulnerabilities in corporate networks.
The study, motivated by efforts to enhance the security of artificial intelligence (AI), demonstrated that AI agents pose a fundamentally new threat.
The Attackers Might Seem to Have an Advantage
The world is already staring at a large digital footprint that can be attacked.
Much of this unprecedented breach exposure is due to emerging digital and AI technologies, hybrid operational models, expanded third-party and supply chain dependencies, workforce decentralization, and unmonitored IT assets, amid geopolitical volatility. As Reuters reported, since the beginning of 2022, the MSCI AI index, which tracks global companies advancing artificial intelligence, has climbed 115%, compared to a 44% rise in the broader MSCI World index.
This has led to an explosion in the digital environment, significantly increasing the attack surface available to attackers and reflecting both the quantitative growth in access points and the qualitative evolution in complexity and risk, especially due to the proliferation of AI adoption.
Leading CISOs and other cyber leaders are suddenly realizing that the attack surface is no longer limited to traditional endpoints.
It Now Includes
- AI workflows,
- AI agents,
- cloud-native assets,
- third-party integrations,
- supplier networks,
- and decentralized human agents.
As per the AI Security Institute (AISI), which built a 32-step corporate network attack simulation spanning initial reconnaissance through to full network takeover, called “The Last Ones” (TLO), also compared the frontier AI cybersecurity models, found Claude Mythos Preview leading the bid to solve TLO from start to finish (other models included Claude Opus 4.6, GPT 5.4, and GPT-5.1 Codex).
But the AI worm takes the situation to a different level. The AI-driven worm requires only an open-weight model that can run on a single local GPU.
Since the worm is powered by stolen compute, the attacker’s marginal cost per new infection is zero. This creates an economic asymmetry between attackers and defenders.
This new possibility of a self-thinking worm creates a substantial material economic asymmetry.
And that is the conversation that must happen in every boardroom on the planet, because the matter is no longer technical only. Defenders will find it significantly expensive to stop the worm. And technically complex, unless we rewire the fundamentals to build breach readiness in the organizational operational fabric.
Rewiring Resilience by Re-Architecting the Blast Radius
While defenders are still wrangling over whether to make the change, attackers are using artificial intelligence to craft the next big attack. That is no comparison at all. Attacks are moving at machine speed, while defenders are debating when business will allow the next patch to be applied.
That is a chasm with multiple layers of gray. It is significant to be addressed today and now.
In the end, human or AI, attackers can attack only those digital assets that are digitally visible. Visibility is thus the new vulnerability. The solution is not to patch faster but to make the unpatched unreachable. Should the most advanced AI-powered worm decide to propagate, the route to the most critical digital systems must be shielded using invisible walls.
The fastest way to do that is to implement a comprehensive breach readiness capability by progressively deploying an EDR-integrated microsegmentation platform that can swiftly reduce the blast radius within hours.
EDR-integrated microsegmentation overcomes the long gestation periods associated with agent-based implementations, reduces agent fatigue, and most importantly, provides far richer and more accurate telemetry to design a breach-ready, unreachable digital enterprise.
Call to Action
We must prepare for more autonomous generative adversaries. Given advances in artificial intelligence model development, future frontier AI models may be far more readily available to attackers. AI-powered malware will not only be very, very fast but also capable of reasoning about targets, adapting to observations, and synthesizing attack logic in real time.
Mythos is dated already. Frontier AI for cybersecurity is old news. We are now in a world where every new month has new developments for cyber defenders.
You can make a difference now. Take the first step.
Conduct a Breach Readiness Impact Assessment, a proactive evaluation that measures an organization’s ability to withstand a cyberattack. The assessment identifies vulnerabilities, maps sensitive data, and quantifies potential financial, operational, and regulatory damage before an incident occurs.
Then take the next logical step to build entropy into your digital enterprise. Contact us to explore how you can make it extremely difficult for attackers to navigate.
Be Breach Ready.
