A team from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow has built a prototype computer virus that does not merely exploit known vulnerabilities. It uses an open-weight large language model to reason about each new host it encounters, then crafts tailored attacks to spread further. The worm parasitically steals GPU resources from compromised machines to run its own inference, making it self-sustaining and independent of any vendor API that could be revoked or monitored.
The researchers say the proof-of-concept runs on a single A100 GPU with 80GB of VRAM, using an open-weight model published in 2025. Because it relies on local hardware rather than cloud APIs, the worm can operate in air-gapped or monitored environments where traditional command-and-control infrastructure would be detected.
Why This Changes the Threat Model
Until now, most autonomous malware has relied on hardcoded exploit chains or pre-programmed behavior trees. This prototype represents a shift toward generative adversaries: agents that can adapt their strategy in real time based on the target environment. The worm scans for vulnerabilities, reasons about how to exploit them, and then uses the compromised machine's GPU to continue the cycle.
The research team is explicit about the stakes. They write that "self-sustaining AI-driven cyber-threats are no longer theoretical" and call for preparation against autonomous generative adversaries. The work was highlighted in Jack Clark's Import AI newsletter, which noted that the combination of open-weight models and well-designed harnesses creates a persistent, self-sufficient threat class.
Pacing AI Progress and Creativity Confusion
The same newsletter issue touched on two broader themes that contextualize the security finding. The first is the difficulty of pacing AI progress: as models become more capable, the window between research publication and malicious adaptation shrinks. The second is ongoing confusion about AI and creativity, particularly whether generative systems produce genuinely novel work or sophisticated recombination. Both debates matter for security because they shape how quickly policymakers and defenders recognize that AI capabilities have crossed into autonomous threat territory.
The worm does not need to be creative in any philosophical sense. It only needs to be effective at scale. That threshold has now been crossed in a laboratory setting, which means the race between open-weight release practices and defensive tooling has entered a new phase.