Adaptive Computer Worms: AI Agents Enable Real-Time Attack Strategy Generation Based on Targets
A study submitted on June 2, 2026 demonstrates adaptive worms driven by open-weight models across Linux, Windows, and IoT networks. These worms leverage the computing power of compromised machines to continue reasoning and propagation, making the marginal cost for attackers to add new infections nearly zero.
Traditional worms rely on fixed vulnerabilities, and patches can cut off propagation. Agent-based malware observes targets, adjusts strategies, and generates attack logic on the fly, without relying on commercial model APIs that may refuse or throttle responses.
The prototype propagates across cross-OS networks using common enterprise vulnerabilities and runs open models on compromised devices to sustain reasoning. The system integrates target reconnaissance, strategy generation, exploit execution, and subsequent propagation, demonstrating how attack code can be dynamically generated based on environmental feedback.
Security defenses must shift from known signatures and fixed IOCs to behavioral isolation, least privilege, lateral movement detection, and monitoring of local compute abuse. Centralized model safety cannot cover offline open models.
Enterprises should prioritize blocking common lateral movement paths, restrict endpoint inference resources and outbound access, and use behavioral drills to test detection and isolation times under adaptive attacks.
Research needs to be reproduced within strict security boundaries, and quantify the impact of different models, network segmentation, and endpoint protections, avoiding the release of operational details that could be directly misused.