A new study describes an AI-powered computer “worm” built to attack and spread between devices. The researchers say it shows self-sustaining AI-driven cyber-threats are no longer theoretical, and warn the world is underprepared—though a key expert calls the wo
For the third time in a week. cybersecurity experts hear a version of the same sentence: the threat isn’t coming from a novel vulnerability—it’s coming from smarter malware. This time. the details sit in a preprint on arXiv.org. not behind a lab’s closed doors. describing an AI-powered computer worm designed to spread between devices.
The researchers say their prototype demonstrates something that until recently lived mostly in scenarios and speculation: “self-sustaining AI-driven cyber-threats” are no longer theoretical. In their paper. first reported by the New York Times and not yet peer-reviewed. they describe a worm intended to attack and move autonomously from one device to another—an approach they argue the world is poorly equipped to counter.
David Lie. a professor at the University of Toronto who is familiar with the research but was not directly involved. calls the work a “wake-up call.” He wants cyber experts and researchers to develop countermeasures to AI-boosted bugs “as fast as possible.” “The demonstration here is that there’s a motivation to do this sooner rather than later. ” he says.
The study’s authors sharpen the warning with a specific design choice. They say they did not use proprietary AI models from companies such as Anthropic or OpenAI. both of which have issued warnings about the threat of their technology being used by bad actors. Instead. the researchers built the worm using an undisclosed but freely available AI model—one they wrote can “anyone can download off the internet. ” according to a post on their lab’s website.
That accessibility matters because it compresses the timeline for misuse. Pre-AI worms, Lie says, were only able to follow certain instructions from their designer. “But because this is AI powered, it can learn,” he adds—meaning the malware isn’t just repeating a script. It is adapting as it spreads.
Still, there is an important limit in the experiment itself. The prototype bug was created in an isolated virtual environment, so it is not going to infect any computers. The researchers’ point is not that the worm is already loose. It is that the logic behind it is becoming easier to replicate.
The authors make their concern explicit, tying it to modern life’s dependence on connected systems. “This research uncovered a new cybersecurity threat the world is not prepared to face,” they wrote in the same post. They also laid out why that preparedness gap is so consequential: with almost every aspect of modern life dependent on networked computers—drinking water and waste management systems. access to food and goods. energy. the financial system. communications. health care. education. transportation systems. government. and “so much more”—the risk is enormous.
Lie’s view of the danger is similarly rooted in how AI changes the game. He argues that AI-powered worms are especially dangerous because they don’t attack a single weakness within a computer system. Instead, the threat can evolve, searching for vulnerabilities as it moves.
At the same time. Lie offers the note that may determine whether this becomes only a scare—or a prompt to build defenses quickly. He calls the technology “dual use.” AI could help a worm learn as it spreads, finding and attacking hidden vulnerabilities. But, he says, AI can also help fix the shortcomings worms exploit. “They’re mirrors of each other.”.
The researchers, for their part, frame the project as a warning shot: “Our results demonstrate that self-sustaining AI-driven cyber-threats are no longer theoretical,” they wrote.
In a world where networks underpin critical services, the gap between “prototype in isolation” and “usable by attackers” may be the real risk the study is forcing into daylight.
AI cybersecurity computer worm malware arXiv preprint machine learning defensive countermeasures