A Free LLM, a Custom Harness, and 27 Compromised VMs: The AI Worm You Don't Need a Lab to Build
University of Toronto researchers built a self-replicating AI worm using only locally-hosted open models. It spread to 82% of its targets. The threat model here isn't frontier AI — it's the misconfigured server you forgot about.
The worm didn't use GPT or Claude. It didn't need to.
Researchers at the University of Toronto's CleverHans Lab built a self-replicating AI agent that spread across a simulated enterprise network using a free LLM running on local hardware. Over seven days and five generations of replication, it reached 27 of 33 systems. No API keys. No frontier model. No subscription.
The failure mode here is one every platform team knows but rarely fixes: the network sitting behind the perimeter is riddled with unpatched CVEs, reused passwords, missing access controls, and SQL injection flaws that haven't moved off the backlog in years. The worm didn't need to be clever. The environment handed it the keys.
In practice, paid API-based models would be a liability for an autonomous attacker anyway. Safety guardrails catch adversarial prompts fast. Local, open-weight models have no such trip wire — and the researchers deliberately picked them for that reason.
The real engineering work was the harness. Locally-hosted LLMs have smaller context windows and weaker instruction-following for agentic tasks than their frontier counterparts. The CleverHans team solved this the same way vibe-coding developers did: break the job into phases, run task-specific sub-agents in parallel, and use a hierarchical memory system to carry discoveries across independent LLM calls. Reconnaissance findings feed into exploitation planning. A compromised machine becomes a new worm instance. The swarm compensates for the 44% exploitation success rate by just throwing more agents at the problem.
The simulated environment wasn't contrived. Target systems ran Ubuntu 16.04 through 24.04, Windows Server 2008 R2 through 2022, Alpine, Debian, Rocky Linux, and CentOS — alongside IoT and ICS devices. Vulnerabilities were drawn from the CISA KEV catalog, OWASP Top 10, and MITRE ATT&CK. Some VMs included GPUs, which the worm used to run its local model after compromising the host, reducing dependence on the researchers' external inference server entirely.
The worm correctly fingerprinted vulnerabilities in 82% of attempts. Exploitation worked 44% of those times — low in isolation, devastating at swarm scale.
This isn't the first agentic offensive framework. Open-source tools like RAPTOR already apply this harness pattern to vulnerability discovery with Claude Code. Forescout's research team used similar frameworks earlier this year to find zero-days in OpenDNS. What Toronto adds is the self-replication layer: the worm carries the framework with it.
Cybercriminals are already watching. Underground forum chatter observed by Forescout shows attackers shifting focus from custom underground models to open-source and commercial ones — exactly the category this worm uses.
Patch your KEV catalog items. Audit your credential reuse. That's the whole post-mortem, written in advance.
