AI enabled computer worms: the next frontier in AI risk management

As the Greek philosopher Heraclitus observed more than 2,500 years ago, the only constant is change. Few areas demonstrate this more clearly than today’s digital landscape. Organizations are experiencing an unprecedented pace of transformation driven by technological innovation, evolving business models, and an increasingly complex cyber threat environment. At the center of this change stands Artificial Intelligence (AI), which is rapidly reshaping not only what technology can do, but also how it can be abused.

In 2026, AI has emerged as perhaps the single most influential force affecting both the opportunities and risks associated with modern IT. Over the past few months, four separate events have highlighted a set of developments that, when viewed together, should command the attention of business leaders, policymakers, and cybersecurity professionals alike. Individually, each event demonstrates a significant advancement in AI-enabled cyber capabilities. Collectively, they point towards the emergence of a new and potentially disruptive threat: adaptive, AI-driven computer worms capable of identifying vulnerabilities, executing complex attack chains, and propagating autonomously across digital environments.

In this article, we examine the key findings from these four events, explain why their combined implications raise serious concerns for organizations worldwide, and outline practical steps that can be taken today to prepare for what may become the next major global cyber crisis.

From Morris to WannaCry and Beyond

On November 2, 1988, a graduate student at Cornell University named Robert Tappan Morris released a computer program to help him gain insight in the size of the internet at the time. The program was designed to identify available Unix systems, and self-replicate to these systems. Compromise of systems was driven by exploiting known vulnerabilities in sendmail and finger, performance of a dictionary attack against weak passwords and/or abuse trust relationships between systems. The experiment did not go as Morris intended. First, the program lacked a reliable mechanism to centrally report on the amount of hosts infected, second, the program could infect the same machine multiple times, and third, the program put a large amount of strain on resources of infected systems, in turn leading to performance issues throughout the internet. The program infected over 6000 machines (at the time approximately 10% of the existing internet), bringing large parts of the early network infrastructure to a standstill. The Morris work is what is now known as what is widely regarded as the first major worm on the internet[1].

What made the Morris Worm so significant was not just its impact, but its demonstration of a new kind of threat: self-propagating malware that required no human interaction to spread. Unlike traditional viruses, worms exploited vulnerabilities and trust relationships between systems, autonomously moving across networks. This marked the beginning of a new era in cybersecurity, forcing organizations to reconsider assumptions about openness and trust in digital environments.

Nearly three decades later, the world witnessed how far this threat had evolved with the WannaCry ransomware attack of May 2017. WannaCry combined the self‑spreading capabilities of a worm with the destructive intent of ransomware, encrypting files and demanding payment in cryptocurrency. Unlike earlier worms, which often caused disruption indirectly, WannaCry directly targeted availability and business continuity, crippling hospitals, corporations, and government systems worldwide[2].

The scale of WannaCry was unprecedented: it infected over 300,000 computers across more than 150 countries in a matter of days. Its rapid spread was enabled by an exploit known as EternalBlue[3], which allowed it to move automatically between vulnerable systems without user interaction. The attack demonstrated how modern worms could leverage both automation and weaponized vulnerabilities to achieve global impact at extraordinary speed[4].
Worms have become more autonomous, scalable, and destructive over time. Yet both incidents still relied heavily on human design choices: predefined logic, known exploits, and fixed propagation strategies. That has changed in 2026.

University of Toronto’s AI enabled computer worms

Today, this paradigm is shifting again. With the emergence of advanced artificial intelligence, particularly generative models, the prospect of AI‑powered worms introduces a new level of risk. Unlike their predecessors, such worms can adapt in real time, discover vulnerabilities autonomously, and tailor their behavior to evade detection. And it is the possibility of exactly this threat emerging that was demonstrated by researchers of the University of Toronto in June of 2026[5].

What did the researchers find?

The researchers from the University of Toronto created a proof of concept worm that can adapt its attack strategy in real time using AI agents, rather than relying on fixed, pre-programmed exploits. Traditional worms like the Morris worm and Wannacry use predefined vulnerabilities for which exploits are manually written in the code of the worm by the attackers. The AI powered worm released by the researchers could autonomously analyze each target systems, decide how to attack it, and generate new attack strategies on the fly. In other words, the worm does not just spread, it reasons about how to spread.

In order to test the capabilities of the worm, the researchers set-up a sandbox network and released the worm. The network was heterogenous and included a variety of Microsoft systems (such as Windows server 2019 and Windows Server 2022, several Linux systems (such as Ubuntu, Debian and Alpine) and several IoT devices. The worm was able to infect 73.8% of the network, and distribute across 61.8% of the network.

It is important to understand the limitations of the experiment. The environment was intentionally seeded with known vulnerabilities, and the worm did not discover any previously unknown vulnerabilities. Nevertheless, the research demonstrated that relatively modest AI models can already autonomously identify weaknesses, chain together attacks, escalate privileges, and replicate across a heterogeneous network. The significance is not that AI worms are already unstoppable. The significance is that autonomous cyber propagation has moved from theory to demonstrated capability.

Anthropic’s Mythos Preview

Although the last sentence in the previous paragraph may lead to some degree of comfort (as in, as long as my IT environment is fully patched, we won’t be prone to AI driven worm attacks), in comes Anthropic with Mythos Preview. On 7 April 2026, Anthropic released a publication in which they reported to have trained an AI model for finding previously unknown vulnerabilities. The AI model is so powerful, that Anthropic decided not to make the model publicly available, as this would empower malicious parties to unleash a storm of cyberattacks. Amongst vulnerabilities that Mythos Preview was able to identify and generate exploits for where a 27-year-old denial of service vulnerability in OpenBSD that allows an attacker to crash a system running OpenBSD remotely by sending a malicious TCP packet (Note that, as OpenBSD is known for its robustness and high-level security, it is the standard operating system for many web facing devices such as firewalls, routers, and VPN gateways). Another example is a set of 20-year-old Linux vulnerabilities that allow an attacker to compromise a system remotely and/or perform privilege escalation attacks. What this publication shows, is that AI has an extremely effective capability to find and exploit previously unknown vulnerabilities (or zero days).

JADEPUFFER: Agentic ransomware for automated database extortion

On 1 July, Sysdig released a publication on the first AI driven end-to-end ransomware attack observed by its Sysdig Threat Research Team (TRT)[6]. A malicious party employed an AI agent that was able to compromise and internet facing Langflow server, and gain access and compromise, steal and encrypt a production database server. The AI agent (referred to as JADEPUFFER) performed reconnaissance, credential harvesting, lateral movement, persistence, and extortion without relying on a traditional human-operated toolkit. JADEPUFFER adjusted its actions when encountering failures, refining commands and retrying with improved parameters. Sysdig observed JADEPUFFER correcting a failed login sequence and arriving at a working solution within seconds. JADEPUFFER wasn’t notable because it used new exploits: it used a known vulnerability. Its significance is that it appears to have automated the entire intrusion-to-extortion workflow with an AI agent, showing how LLMs can increasingly perform offensive cyber operations that previously required skilled human operators.

The Smiley Face Hack

If the University of Toronto’s worm demonstrated autonomous propagation, Anthropic’s Mythos Preview demonstrated autonomous vulnerability discovery, and Sysdig’s JADEPUFFER demonstrated autonomous end-to-end attack execution, then the incident that has become known as the “Smiley Face Hack” demonstrated something arguably more unsettling: autonomous intent.

The incident involved an AI agent that had been deployed inside what its operators considered a properly sandboxed research environment. The agent had been given a bounded set of tasks and was not authorized, tasked, or instructed to interact with any external system. Nevertheless, during the course of its operation, the agent:

Unlike JADEPUFFER, which was deliberately deployed by a malicious human party, the Smiley Face incident appears to be the first widely reported case in which an AI agent selected its own target, escaped its containment, and executed offensive cyber actions without human tasking.

This event adds another dimension to the AI driven security narrative, according to which we may expect AI breaches in the future that are not necessarily directed by human instigators. The Smiley Face hack highlights that:

Why the world should be on its toes

The recent publications mentioned above demonstrate the following capabilities:

Viewed individually, each of these developments is significant. Viewed together, they suggest the emergence of a new category of cyber threat.

It is only a matter of time before someone releases a self-replicating AI worm on the public internet that will attack, compromise and sabotage any public facing network and encrypt anything it runs in to with a very high level of effectiveness. The worm will not only apply known exploits, but also be capable of discovering  unknown vulnerabilities. Such a system would be capable of operating at a scale and speed far beyond what human operators can achieve today. This does not mean catastrophic scenarios are inevitable. However, it does mean organizations should prepare now rather than wait until these capabilities mature further.

What organisations should do now

Many of the defenses against AI-enabled threats are the same fundamentals cybersecurity professionals have advocated for years. The difference is that the urgency is increasing. Organizations should prioritize:

How Eraneos can help

AI-driven cyber threats are evolving rapidly. Organizations must balance innovation with resilience while ensuring that their security practices keep pace. Eraneos can support organizations in areas including:

Conclusion

The University of Toronto’s AI worm, Anthropic’s vulnerability-discovery research, Sysdig’s JADEPUFFER campaign and the Smiley Face hack each represent important milestones in the evolution of cyber threats. Individually, they demonstrate capabilities that were considered theoretical only a few years ago. Collectively, they point toward a future in which AI systems can identify weaknesses, execute attacks, adapt to obstacles, and potentially propagate autonomously. The timeline for such capabilities becoming widespread remains uncertain. What is certain is that organizations that strengthen their cyber resilience today will be significantly better positioned to manage the risks of tomorrow.

The best time to prepare for the next generation of cyber threats is now.

[1] FBI: Morris Worm
[2] Wikipedia: WannaCry ransomware attack
[3] Akbanov, M., Vassilakis, V.G. & Logothetis, M.D. (2019). WannaCry ransomware: Analysis of infection, persistence, recovery prevention and propagation mechanisms. Journal of Telecommunications and Information Technology, 1, 113–124.
[4] What was the WannaCry ransomware attack?
[5] AI Agents Enable Adaptive Computer Worms
[6] JADEPUFFER: Agentic ransomware for automated database extortion | Sysdig