University of Toronto · 2026-06-03 · major
U of T's CleverHans Lab Shows AI Agents Enable Adaptive Computer Worms — Open-Weight LLMs Running on Captured Hosts Compromise ~75% of a 33-Machine Network in One Week With No Human Input, Pulling in Live Vulnerability Advisories Mid-Attack
Six U of T CleverHans Lab researchers ship an arXiv paper showing a worm that runs an open-weight LLM locally on each captured host can plan and tailor attacks per device, hitting ~75% of a 33-machine network in a week with zero human input.
U of T's CleverHans Lab shows an open-weight LLM running locally on a captured host can power a worm that pivots through a corporate network, no humans needed.
Key specs
| Network size (simulated) | 33 machines |
|---|---|
| Compromise rate | ~75% in 1 week |
| Persistence rate | ~67% |
| Test runs | 15 |
| Human input | 0 |
| Ar xiv id | 2606.03811 |
What is it?
AI Agents Enable Adaptive Computer Worms is a new arXiv paper from Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia, Gabriel Huang, and Nicolas Papernot at the University of Toronto's CleverHans Lab and Vector Institute. It demonstrates a proof-of-concept worm that compromises a host, runs an open-weight LLM on the captured machine, and uses that local model to plan its next move against each subsequent target. The authors deliberately withhold the model name and some implementation details to limit copy-paste misuse.
How does it work?
The worm packages a local agent stack: harvest credentials, fingerprint each new device, ingest live public vulnerability advisories so it can exploit flaws the model never saw during training, then tailor a per-host attack across Linux, Windows, and IoT targets. In a simulated 33-machine corporate network, Fortune reports the worm compromised about 75% of hosts within a week and held persistent access on roughly 67% across 15 runs, with no human in the loop. Marginal infection cost approaches zero once a single host is captured — the worm steals the compute it needs to keep reasoning.
Why does it matter?
The paper changes the threat model. Adaptive, reasoning-based malware is operationally feasible on commodity open-weight models, which means centralized API gating and provider-side safety controls cannot stop it. The authors argue the asymmetry between attacker and defender flips when the per-infection cost is effectively zero. Landing the same week as Anthropic's MITRE-mapped Frontier Red Team census of real Claude misuse, U of T's worm gives a concrete lower bound on how cheap autonomous offense from open weights has already become.
Who is it for?
security researchers, blue teams, AI safety + misuse policy researchers, frontier-lab safety teams, CISOs
Try it
Read the paper on arXiv: https://arxiv.org/abs/2606.03811