Researchers at the University of Toronto have built and tested a self-replicating AI computer worm that runs entirely on a locally hosted open-weight large language model, no commercial API required. The preprint, posted to arXiv on June 2 and discussed widely in the security press through June 9, 2026, is the most concrete demonstration yet that autonomous AI attacks are no longer theoretical.
How It Spreads
The worm uses a single-GPU open-weight LLM to reason its way through a network: it inspects exposed services, reads fresh CVE advisories, generates a tailored attack path for each target, and writes its own propagation code at runtime. In 15 isolated runs on a deliberately vulnerable 33-host test network, it identified an average of 31.3 vulnerabilities, gained elevated access on 23.1 hosts (about 75% of the targets it tried) and replicated to 20.4 hosts over seven days with no human input.
Why It Breaks Today's Playbook
Most enterprise defense leans on single-CVE patching and signature-based detection. The Toronto worm renders both fragile: it adapts on the next host instead of replaying a fixed exploit chain, and it never phones home to OpenAI, Anthropic or any other API that defenders could throttle. Importantly, the researchers used a freely available model — no Claude Mythos or other frontier API was required — which means defenders cannot count on rate-limited commercial models to slow attackers down.
Industry Response
The research was discussed at Infosecurity Europe and amplified by Fortune, Help Net Security and The Register. It lands the same week CISA flagged an actively exploited LiteLLM flaw and Anthropic shipped Mythos 5 for cyber defenders inside Project Glasswing. Together they sketch a 2026 threat model in which attackers can field agentic malware on commodity hardware while defenders scramble to retire AI-gateway bugs.
Reporting based on coverage from Help Net Security, The Hacker News, Fortune and The Register.