Researchers have demonstrated the first adaptive computer worm based on artificial intelligence that is capable of independently analyzing a new target, selecting a method of infiltration, and changing its propagation strategy.

Over the past few years, artificial intelligence has been rapidly transforming the field of cybersecurity. First, AI learned to write malicious code; then, it learned to generate convincing phishing emails and create fake websites with virtually no human intervention.

Now the researchers have taken the next step.

The research paper “AI Agents Enable Adaptive Computer Worms” presented the first prototype of a computer worm that uses a language model not as a supporting tool, but as a full-fledged decision-making mechanism.

It is important to note right away that this is not a virus spreading online, but rather a controlled scientific experiment conducted on an isolated laboratory network. The authors intentionally withheld a number of technical details that could make it easier for malicious actors to create similar malware.

---

How Does the New Worm Differ from Common Viruses?

Virtually all known computer worms operate according to a predefined script.

They know what vulnerabilities to look for, how to infiltrate a system, and what to do after compromising it.

This is exactly how many well-known attacks, including WannaCry, spread. As soon as developers released a patch for a specific vulnerability, the effectiveness of such a worm dropped sharply.

In their new study, the researchers proposed a completely different approach.

Instead of a fixed algorithm, the compromised machine runs a language model that independently analyzes each new target.

During an attack, she can:

• determine the operating system;
• explore open services;
• evaluate the device's configuration;
• identify potential entry points;
• select the most appropriate method of penetration;
• change the strategy if the previous attempt was unsuccessful.

In fact, malware ceases to be a set of pre-written instructions and begins to make decisions on its own.

---

How the experiment was conducted

The tests were conducted on an isolated corporate network consisting of 33 devices.

The infrastructure included computers running Windows and Linux, as well as IoT devices.

The researchers conducted 15 independent system runs.

The average results were as follows:

Indicator	Meaning
Number of devices	33
Duration of the experiment	7 days
Potential vulnerabilities found	around 31
An elevated access level has been granted	about 74% of devices
Successfully infected	more than 60% of devices
Maximum propagation depth	7 generations

Even if an attempt to exploit a vulnerability failed, the system did not stop working. Instead, the AI analyzed the situation, chose a different method of attack, and continued to search for new ways to gain access.

It is precisely this ability to change strategy on the fly that has become the key distinguishing feature of this new development.

---

The most alarming finding of the study

One of the goals of this study was to test whether a language model could use information about vulnerabilities that was published after its training had been completed.

The answer turned out to be yes.

During operation, the system analyzed the latest security bulletins and used the information it found to develop new operational scenarios.

This means that the date the model was trained is no longer a major constraint.

If AI is capable of acquiring new knowledge while operating, the potential of such systems expands significantly.

---

Why Researchers Abandoned Cloud-Based AI

Another interesting aspect of the study is that the authors did not use commercial cloud services.

Instead, an open language model that runs locally on infected devices was chosen.

This approach offers several advantages at once:

• No dependency on an external API;
• It is not possible to simply shut down the central server;
• Each new infected machine provides computing resources to facilitate further propagation.

In other words, the attack infrastructure can be gradually built using the victims' own resources.

---

Why This Is Important for the Crypto Industry

At first glance, the study does not appear to be related to cryptocurrencies.

However, the crypto industry in particular could become one of the most attractive targets for such technologies.

Such systems are potentially capable of automatically searching for:

• seed phrases;
• private keys;
• files from popular crypto wallets;
• validator infrastructure;
• corporate exchange networks;
• poorly secured Web3 applications.

We've already discussed how artificial intelligence is turning crypto fraud into a full-fledged industry, and we’ve also examined a new type of attack Transaction Simulation Phishingthat allows attackers to bypass transaction verification mechanisms in Web3 wallets.

A new study reveals the next stage in the evolution of threats.

Whereas AI used to help cybercriminals create phishing websites and messages, it is now beginning to make decisions on its own during the attack itself.

---

What does this mean for the future?

The primary value of the research lies not at all in creating a new virus.

The authors demonstrated that artificial intelligence has the potential to transform the very approach to developing malicious software.

In the past, security was based on identifying specific vulnerabilities and releasing security updates.

Now there is a new class of programs that can independently analyze their environment, adjust their own strategy, and adapt to various systems in near real time.

So far, this is just a laboratory experiment.

However, the history of information security has repeatedly shown that many ideas that first appear in academic publications end up being used in real-world attacks a few years later.

---

Conclusion by KLYO

Just a few years ago, scenarios like these seemed like the stuff of science fiction. Today, researchers are already demonstrating AI capable of independently analyzing targets, selecting a method of intrusion, and adapting its actions during a cyberattack.

For now, this is just a laboratory experiment. But it is often experiments like these that give rise to technologies that, years later, become part of the real world.

If artificial intelligence continues to develop at this pace, the famous “Judgment Day” from *The Terminator* will no longer seem like such a distant fantasy. I’d like to believe that, before our own Skynet emerges, humanity will still have time to build a reliable defense system.

---

Sources

• AI Agents Enable Adaptive Computer Worms (research paper, arXiv)
• University of Toronto — Research on Adaptive AI Worms