Researchers at the University of Toronto have demonstrated an AI-powered worm capable of adapting its behaviour as it moves through networks, a development that could reshape how cybersecurity experts think about future threats.
The proof-of-concept system was created in a controlled laboratory environment by researchers from the university’s CleverHans Lab and the Vector Institute. According to the team, the experiment showed that publicly available AI models can be used to build malware that adjusts its strategy based on the systems it encounters.
Traditional worms typically follow a fixed set of instructions. The AI worm demonstrated by the researchers can analyse its surroundings and make decisions about how to continue spreading, allowing it to respond to different devices and network conditions.
The project was designed to explore how advances in artificial intelligence could change the threat landscape rather than create a weaponised tool for real-world use.
“Our goal was to understand this threat in a controlled, academic setting before malicious actors figure it out themselves,” said Nicolas Papernot, associate professor at the University of Toronto and Canada CIFAR AI Chair.
The researchers argue that AI-driven malware could lower the barrier to entry for cybercriminals by allowing attackers to automate tasks that would normally require specialised expertise. Because the demonstration relied on publicly available AI models, the team says the technology needed to create similar threats may already be widely accessible.
According to the researchers ( Papernot, Jonas Guan, Tom Blanchard, Hanna Foerster, Hengrui Jia and Gabriel Huang), adaptive malware presents a challenge for existing security systems, many of which are designed to detect known patterns of behaviour rather than software capable of changing its tactics on the fly.
The work focused on understanding potential risks and identifying weaknesses before they can be exploited. To reduce the possibility of misuse, the team did not publish technical details that could enable others to recreate the system.
While the AI worm remains a research project, the demonstration highlights a growing concern within the cybersecurity community: artificial intelligence is becoming a powerful tool not only for defenders but also for attackers.
As organisations continue to connect more devices and services to the internet, security experts warn that adaptive threats powered by AI may become an increasingly important area of focus in the years ahead.
