A Free LLM, a Custom Harness, and 27 Compromised VMs: The AI Worm You Don't Need a Lab to Build
University of Toronto researchers built a self-replicating AI worm using only locally-hosted open models. It spread to 82% of its targets. The threat model isn't frontier AI, it's the misconfigured server you forgot about.
Key points
- A self-replicating AI worm built on a free, locally-hosted LLM spread to 27 of 33 simulated enterprise systems over seven days.
- The worm correctly identified vulnerabilities in 82% of attempts and successfully exploited them in 44% of those cases.
- No API keys, no frontier model and no safety guardrails to trip over.
- A hierarchical multi-agent framework compensated for weaker local LLM performance by running task-specific sub-agents in parallel.
- Underground forum chatter observed by Forescout shows attackers already shifting toward the open-source model category this worm relies on.
What did the Toronto researchers actually build?
Researchers at the University of Toronto's CleverHans Lab built a self-replicating AI agent that spread across a simulated enterprise network using a free LLM running on local hardware. Over seven days and five generations of replication, it reached 27 of 33 systems. The failure mode is one every platform team knows but rarely fixes: unpatched CVEs, reused credentials, missing access controls and SQL injection flaws that haven't moved off the backlog in years. The worm didn't need to be clever because the environment handed it the keys.
Paid API-based models would actually be a liability for an autonomous attacker. Safety guardrails catch adversarial prompts quickly. Local, open-weight models have no such trip wire, and the researchers picked them deliberately for that reason.
Should you worry about the framework more than the model?
The real work was the agentic framework. Locally-hosted LLMs have smaller context windows and weaker instruction-following for agentic tasks than frontier models. The CleverHans team addressed this the same way developers building on constrained local models did: break the job into phases, run task-specific sub-agents in parallel and use a hierarchical memory system to carry discoveries across independent LLM calls. Reconnaissance feeds into exploitation planning. A compromised machine becomes a new worm instance. Our earlier story "Treat the Model Like a Threat" reached a similar structural conclusion: prompt-level defences are inadequate once the agent is already inside the environment.
How realistic was the test environment?
Target systems ran Ubuntu 16.04 through 24.04, Windows Server 2008 R2 through 2022, Alpine, Debian and Rocky Linux, alongside IoT and ICS devices. Vulnerabilities came from the CISA Known Exploited Vulnerabilities catalog, the OWASP Top 10 and MITRE ATT&CK. Some VMs had GPUs, which the worm hijacked to run its local model after compromise, reducing dependence on the researchers' external inference server.
The worm correctly fingerprinted vulnerabilities in 82% of attempts. Exploitation succeeded in 44% of those cases. Low in isolation, but at swarm scale the parallel architecture turns that rate into broad coverage.
What comes next?
This isn't the first agentic offensive framework. RAPTOR applies the same pattern to vulnerability discovery. What Toronto adds is self-replication: the worm carries the framework with it.
Patch your KEV catalog items. Audit credential reuse. That's the whole post-mortem, written in advance.
