AI Worm Prototype Reveals: Attackers Can Infiltrate Corporate Networks Without Cutting-Edge AI

Introduction

While the industry's attention remains fixated on the ability of cutting-edge AI models (such as Anthropic's Mythos) to discover zero-day vulnerabilities, a new study from the University of Toronto sounds the alarm: attackers do not need the most advanced AI at all. With merely free, local open-source large language models (LLMs), they can build an autonomously propagating AI worm that penetrates the most common weak links in enterprise networks. This experiment reveals a dangerous race between enterprise security debt and AI-automated attacks, and it means defenders must respond at an unprecedented speed.

Event Overview

• Time: Research paper and report published in June 2025
• Organization: University of Toronto's CleverHans Lab (Cybersecurity Lab)
• Technical Background: Researchers used open-source LLMs (such as small quantized versions of the Llama series) deployed on local GPUs to build a prototype called the "AI Worm". This worm enhances model capabilities through a custom agentic framework (similar to RAPTOR), breaking tasks down into multiple sub-tasks.
• Known Facts:
• - Deployed 33 virtual machines in a simulated network, running various operating systems including Ubuntu, Debian, and Windows Server, and set up unpatched old vulnerabilities, newly disclosed vulnerabilities, and common configuration errors (such as weak passwords and unauthorized access).
• - The worm completed 5 generations of self-replication within 7 days, successfully infecting 27 systems (82% recognition rate, 44% exploitation success rate).
• - The worm was able to exploit weaknesses recorded in the CISA Known Exploited Vulnerabilities (KEV) catalog, OWASP Top 10 2025, and the MITRE ATT&CK framework.
• - Some virtual machines were equipped with GPUs; after infection, the worm hijacked the GPU computing power to run its own LLM nodes, achieving self-sustainability without requiring external API calls.

Technology and Risk Analysis

Attack Method

The AI worm in this study is not a novel attack method but rather pushes existing attack automation to new heights. It combines the following techniques:

• Agentic Harness: Researchers reused methods from software engineering to overcome the limitations of local LLM capabilities—building custom “toolkits” and “skill systems” to decompose the penetration task into steps such as scanning, fingerprinting, vulnerability matching, code compilation, privilege escalation, and lateral movement.- Agentic Harness: Researchers repurposed methods used in software engineering to address the limitations of local LLMs—building custom "toolkits" and "skill systems" that decompose penetration tasks into steps such as scanning, fingerprinting, vulnerability matching, code compilation, privilege escalation, and lateral movement. Each step is invoked by a dedicated agent, sharing findings through a hierarchical memory system. This aligns with the approaches of open-source projects like RAPTOR and SecOpsAgentKit.
• Memory and Context Management: Since local LLMs have smaller context windows, the framework uses external databases or files to store probe results, enabling different agents to maintain state across calls.
• Multi-Agent Parallelism: Each compromised system becomes a new agent instance, creating a "swarm" effect. Even if individual agents have low success rates, the overall penetration efficiency remains high.

Exploit Chain

1. Initial Access: The worm scans the network to discover open ports and running services, then matches known vulnerabilities (e.g., old OpenSSH vulnerabilities, unpatched web applications) for remote exploitation. 2. Privilege Escalation: Once an initial shell is obtained, the worm exploits local privilege escalation weaknesses (e.g., misconfigured SUID, unauthorized system calls) to gain root or System privileges. 3. Lateral Movement: From compromised hosts, it scans the internal network and repeats the exploitation process. 4. GPU Hijacking: If the target system has a GPU, the worm deploys a quantized LLM in the background, replacing external model calls, making the attack more covert and cost-effective. 5. Data Theft and New Attacks: The worm can steal data or launch further attacks (e.g., DDoS, ransomware).

Affected Assets

Covers almost all common devices in enterprise networks:

• Endpoints: Laptops, servers.
• IoT Devices: Cameras, smart sensors.
• Industrial Control Systems: Simulated SCADA systems.
• Cloud/Virtual Environments: Virtual machines and containers.

Risk Level

• High: Especially for enterprises with significant security debt (untimely patching, lax configurations).

Enterprise Impact Analysis

Operational Risk AI worms can bypass traditional signature-based detection because they dynamically adjust attack payloads based on the target environment. Additionally, since they exploit known vulnerabilities and misconfigurations, they can cause widespread disruption in large enterprises with lagging maintenance.

Financial Risk - Hijacking GPU compute power for mining or self-operation increases cloud or on-premises computing costs. - Data breaches can lead to fines, lawsuits, and ransom payments. - Removing the worm requires significant security personnel time.### Compliance Risk If the vulnerability exploited by the worm is a known vulnerability that regulatory bodies (such as CISA) require to be patched, enterprises may violate compliance requirements (e.g., PCI-DSS, NIST CSF) due to delayed remediation.

Brand Risk The automated nature of such attacks allows them to spread rapidly; once made public, the enterprise’s reputation will suffer.

Data Risk Worms can steal sensitive data, and because they are agent-driven, they may selectively target high-value data.

Industry Trend Observations

This Is Not an Isolated Incident The University of Toronto study is not an isolated case. In early 2025, Forescout research had already shown that open-source models, with the help of specific agentic frameworks, could discover zero-day vulnerabilities (e.g., finding a zero-day in OpenDNS). Daniel dos Santos (VP of Research at Forescout) noted that attackers on cybercrime forums are increasingly focusing on open-source and commercial models rather than dedicated “underground” models.

Trend: Democratization of AI-Powered Automated Attacks In the past, writing a worm required deep programming and vulnerability exploitation skills. AI agents now allow attackers to describe targets in natural language and let the model autonomously complete complex steps. This significantly lowers the barrier to entry.

Key Finding: Attackers Don’t Need Mythos The research team emphasized: “We achieved this using only small, free AI models.” This conclusion means the security community should not only focus on frontier model bans or guardrails but also be wary of the destructive power of local LLMs combined with agent frameworks.

Impact on the Industry - Security Vendors: Must accelerate AI-driven detection and response technologies, such as behavioral analysis, anomaly detection, and agent-based threat hunting. - Cloud Service Providers: Need to strengthen abuse detection of GPU resources (e.g., unusually high compute consumption). - Compliance Standards: May require enterprises to possess “AI attack emergency response capabilities.”

Defense and Response Recommendations

Enterprise Level - Accelerate Patch Management: Research shows worms can integrate exploits within hours of vulnerability disclosure. Enterprises must shorten remediation windows, especially for vulnerabilities in the CISA KEV catalog. - Strengthen Identity and Access Management: Implement multi-factor authentication (MFA) and the principle of least privilege to prevent worms from using weak passwords for lateral movement. - Zero Trust Architecture: Implement micro-segmentation to prevent worms from spreading freely within the network.

Technical Level - Deploy EDR/XDR: Although this worm was designed to be relatively “noisy” (leaving behavioral signatures), AI variants may be more stealthy.### Technical Level - Deploy EDR/XDR: Although this worm is designed to be relatively "noisy" (leaving behavioral signatures), AI variants may be more stealthy. Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) combined with behavioral analysis are critical. - AI-Assisted Penetration Testing: Enterprises should proactively use similar AI agent frameworks to scan their own environments (e.g., using RAPTOR) to discover weaknesses before attackers do. - GPU Usage Monitoring: Establish baselines and alert on anomalous GPU compute usage in real time.

Management Level - Incident Response Plan Updates: Conduct drills for scenarios involving AI-driven automatic attacks to ensure teams can quickly isolate affected systems. - Third-Party Risk Management: Check whether vendors have patched known vulnerabilities to prevent supply chain introduction of such worms. - Security Governance: Establish a "security debt" metric to regularly assess the number and risk of unpatched vulnerabilities.

SecurityPost Insight

The experiment conducted by the University of Toronto marks a watershed moment in cybersecurity. It clearly demonstrates that the most threatening attacks in the future may not rely on scarce zero-day vulnerabilities, but instead leverage widespread security debt in enterprises, using AI agents to chain known weaknesses into automated destruction paths.

For CISOs, the lesson is twofold: on one hand, they must immediately address deficiencies in patch management and configuration standards; on the other hand, they should accelerate the adoption of AI-assisted security tools from an attacker’s perspective, shifting from reactive to proactive. As Gadi Evron (CEO of Knostic) stated: "We no longer have time to measure 'time to exploit'; we need to measure the ability to handle concurrent data breaches and minimize business impact."

It is worth noting that this prototype is still in its early stages, but it demonstrates the future direction of AI-driven automated attacks. The security community must jointly innovate defensive mechanisms, including controlled AI agent hunting, GPU abuse detection, and cross-industry information sharing. Time is of the essence.