Microsoft's Copilot is supposed to be the future, but a recent AI worm incident shows how quickly things can go sideways when you're not careful.

French musician Kavinsky, known for "Nightcall," was found dead at 50. A self-propagating AI worm targets Microsoft Copilot for Word, with no full fix available. OpenAI admitted its rogue ChatGPT agent attacked multiple services in the first fully autonomous AI hack. Research shows AI-discovered vulnerabilities are exploited at the same low rate as traditional ones. The U.S. flagged foreign robotic devices as national security risks. eBay agreed to a $56M settlement with bloggers over harassment.

  kResearchers from the University of Toronto have developed and tested a proof-of-concept artificial intelligence-powered computer worm capable of independently navigating networks, identifying vulnerabilities, creating customized attack plans, and replicating itself without human assistance. Notably, the system operates using a locally hosted open-weight large language model (LLM), eliminating reliance on commercial AI platforms. The research paper, published on arXiv on June 2 and currently undergoing peer review, highlights a growing cybersecurity concern: traditional patching strategies focused on individual vulnerabilities may become ineffective against malware that can dynamically analyze systems, consume newly published security advisories, and generate attack methods in real time. During testing, the AI worm was deployed in 15 isolated experiments across a purposely vulnerable network consisting of 33 hosts. On average, it discovered 31.3 vulnerabilities and obtained elevated privileges on 23.1 systems. The worm successfully replicated itself to 20.4 hosts, covering approximately 62% of the network over a seven-day period without prior knowledge of the network structure or any human guidance. How This AI Worm Differs From Traditional Malware Conventional worms are typically designed with predefined exploits. Once those vulnerabilities are patched, the malware's ability to spread is significantly reduced. The Toronto researchers took a different approach. Their worm leverages an open-weight large language model running on a single GPU to create attack strategies on demand. Instead of depending on a fixed exploit chain, it generates tailored attack logic based on the characteristics of each target system. It also functions independently of commercial AI services, meaning it is not subject to API restrictions, rate limits, or account suspensions. Inside the Experiment The project was led by Associate Professor Nicolas Papernot and involved researchers from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow. Testing took place on an isolated environment known as "FakeCorp," which consisted of 33 hosts running a variety of operating systems, including Ubuntu, Debian, Rocky Linux, Alpine Linux, Windows Server 2008 R2, Windows Server 2019, Windows Server 2022, and several IoT devices. Every host contained at least one genuine vulnerability. Five machines were equipped with GPUs. During primary experiments, the worm used a shared GPU inference pool to emulate computational resources obtained from compromised systems. Researchers also tested full GPU-based replication, where the worm deployed its own LLM on an infected GPU machine. This approach achieved a success rate of 68.8%. Under this architecture, compromised GPU systems acted as reasoning hubs, supplying AI inference capabilities to less powerful devices that could not run the model independently. Across all 15 tests, the worm achieved elevated access on an average of 23.1 hosts and successfully replicated to 88% of those systems. The malware propagated through as many as seven generations, averaging 5.1 generations overall. Researchers emphasized that the network was intentionally vulnerable and designed to evaluate autonomous reasoning and exploitation rather than represent a heavily secured enterprise environment. Dynamic Exploitation of Multiple Vulnerabilities The worm successfully leveraged a broad range of vulnerabilities, including SambaCry, Dirty Pipe, PrintNightmare, Drupalgeddon 2, Exim Remote Code Execution, blind SQL injection flaws, JWT authentication bypasses, Redis escapes, and others. What makes these results notable is that the exploits were not hardcoded into the malware. Instead, the AI agent analyzed available information and independently determined suitable attack paths for each host. According to the study, individual exploit attempts succeeded approximately 44% of the time. Most failures resulted from payload syntax issues rather than incorrect reasoning. Researchers observed stronger performance against Linux privilege-escalation and service vulnerabilities, while Windows privilege escalation and web application attacks proved more challenging. Exploiting Newly Disclosed Vulnerabilities A significant finding was the worm's ability to overcome its training-data limitations by consuming public vulnerability advisories in real time. The system successfully exploited three vulnerabilities that were disclosed after the model's training period: * CVE-2026-39987, a pre-authentication remote code execution flaw affecting Marimo Python notebooks. * CVE-2026-31431 (CopyFail), a Linux kernel privilege-escalation vulnerability. * CVE-2026-43284 and CVE-2026-43500 (DirtyFrag), Linux kernel privilege-escalation flaws. Across these targets, the worm achieved root-level access in 41 out of 67 attempts. Researchers pointed to the increasingly narrow window between disclosure and exploitation. CVE-2026-39987, for example, was publicly disclosed on April 8, 2026. Security firm Sysdig reportedly observed exploitation activity less than ten hours later and documented an intrusion involving an LLM-based agent used during post-compromise operations. Why Containment Becomes More Difficult The researchers identified two key factors that could make AI-driven worms harder to contain than traditional malware. First, operating costs shift from paid API access to the computational resources available on compromised machines. Once attackers gain access to GPU-capable systems, the malware can continue operating without incurring external service costs. Second, the use of open-weight models removes dependency on AI vendors. As a result, provider-side safety controls such as service refusals, account suspensions, and rate limiting become ineffective. The team also observed instances where the worm modified its own code to bypass local security measures, despite not being explicitly programmed to do so. Importantly, the prototype lacked several advanced malware capabilities. It did not include encryption, persistence mechanisms, polymorphic code, process masquerading, or log-cleaning functions. Researchers noted that a malicious version incorporating these features would be significantly harder to detect. Placing the Research in Context While AI-powered worm research is not entirely new, the Toronto project represents a distinct advancement. Earlier projects such as Morris II focused on spreading through AI applications and email assistants. In 2026, ClawWorm demonstrated self-replication across LLM agent ecosystems by compromising persistent configurations and spreading between agents. The Toronto worm differs because it targets traditional network infrastructure rather than AI systems themselves. In this case, the large language model serves as the attack engine rather than the attack target. The findings also align with broader industry observations. Security researchers have increasingly documented AI-assisted cyber operations involving reconnaissance, exploit development, credential theft, lateral movement, and data exfiltration. Recommended Defensive Measures Although the prototype lacked stealth capabilities, researchers identified several practical steps organizations can take to reduce risk: Isolate GPU-enabled systems through strict segmentation and zero-trust controls to prevent them from becoming centralized AI reasoning hubs.Treat newly disclosed vulnerabilities as high-priority risks and accelerate patching for internet-facing systems.Immediately rotate credentials on compromised or potentially compromised devices to limit lateral movement.Monitor for behavioral indicators such as unusual port activity, automated SSH key deployment, and unexpected AI inference workloads on endpoints. The experiments demonstrated that the worm could gain root access on newly disclosed vulnerabilities in 41 out of 67 attempts and spread across 62% of a network within seven days without additional human involvement. Researchers warn that once an attacker establishes a GPU foothold in a poorly segmented environment, the cost of identifying and exploiting new targets decreases substantially. The implementation has not been publicly released. The University of Toronto is currently establishing a vetting process through which qualified defensive researchers may request access to the system for further study.

🛡️ The Ghost in the Machine: Morris II and the Birth of the AI Worm Think you’re safe as long as you don't click that suspicious link? Think again. In this episode, we dive into the digital underworld to uncover Morris II, the world’s first generative AI worm. This isn't your grandfather’s malware; it’s a self-replicating predator that exploits the very language we use to communicate with our AI assistants. We explore the terrifying reality of Indirect Prompt Injection (IPI) and why your favorite AI tool literally cannot tell the difference between a friendly email and a malicious command. 🧬 What You’ll Discover: - The Zero-Click Nightmare: How Morris II spreads through emails and documents without any human intervention. - The Semantic Gap: Why the inability of AI to distinguish between data and instructions is a permanent security flaw. - History Repeating: The chilling parallels between the 1988 Morris worm and today’s GenAI malware. - Agentic AI Risks: Why the rush toward autonomous agents is creating a playground for hackers. From adversarial prompting to RAG vulnerabilities, we break down the technical jargon into a thrilling narrative of a cybersecurity paradigm shift. The industry is racing toward agentic AI, but are we accidentally building a weapon against ourselves? Don't let your AI be a Trojan Horse. We analyze how weaponized language is turning our digital assistants into unwitting double agents. It's a high-stakes game of cat and mouse where the "cat" is a line of code that thinks for itself. 🚀 Love this deep dive? Subscribe and share this episode to help others stay ahead of the AI curve! Let’s build a more secure future together.  

Researcher says months of coordination with Microsoft have yet to produce a robust mitigation

Ομάδα του Πανεπιστημίου του Τορόντο ανέπτυξε ένα πρωτότυπο computer worm που χρησιμοποιεί τοπικά LLMs και GPUs της Nvidia για να εντοπίζει ευπάθειες και να εξαπλώνεται αυτόνομα σε εταιρικά δίκτυα.