How AI Worms Propagate: The Full Lifecycle, From Adaptive Exploits to Autonomous Inference

AI worms work by turning the malware model itself inside out. Instead of carrying a fixed exploit that fails the moment a target is patched, a worm built around large language models reasons about each machine it encounters, writes target-specific attack logic on the fly, and then—once it has a foothold—installs and runs its own AI model on hardware it has never seen before. Two recent research efforts, one from the CleverHans Lab demonstrating an adaptive computer worm and one from Anthropic measuring the self-replication chain, describe complementary halves of this cycle. Synthesized, they show a four-stage propagation process that traditional patching alone cannot stop.

Understanding the AI Worm Threat

A computer worm is self-replicating malware that spreads across a network without human intervention. What changes with AI is the engine driving that replication. The CleverHans Lab researchers, whose preprint is titled "AI Agents Enable Adaptive Computer Worms," describe a proof-of-concept worm whose attack logic is generated at runtime rather than fixed in advance. Their conclusion is blunt: self-sustaining AI-driven cyber-threats are no longer theoretical, and defenders must prepare for "autonomous generative adversaries: malware systems that propagate without human operators and are defined not by fixed exploit code, but by the capacity to reason about targets, adapt to observations, and synthesize attack logic in real time."

The scale of the shift becomes clear against a familiar benchmark. The WannaCry worm of 2017 disrupted critical infrastructure across 150 countries by exploiting a single vulnerability—and it could be stopped by patching that one flaw. The adaptive prototype cannot be stopped the same way, according to its creators, because it uses a recursive reasoning loop to detect and exploit diverse vulnerabilities as it propagates. Each compromised machine becomes part of the worm's own infrastructure, providing compute or reach for further attacks. Crucially, all of this was demonstrated in a controlled experiment on an isolated virtual network, not observed in the wild.

The Adaptive Propagation Cycle of AI Worms

Anthropic's research on self-replicating AI provides the cleanest skeleton for the propagation cycle. The company decomposes autonomous replication into four practical stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Anthropic notes that it largely ignored the exploit element of the process, because earlier work—including the adaptive worms paper—already shows that small models are capable of cyber exploits when given the right tools. Its focus was the less commonly measured stage: setting up inference on compromised devices.

That division of labor is what makes a consolidated model possible. The CleverHans research supplies the front half of the cycle—how an AI worm finds and breaches machines—while Anthropic's work supplies the back half: how the worm becomes operational on a new host and launches the next generation. The two studies were conducted independently, but their stages interlock. The table below sequences them into a single lifecycle.

The AI Worm Propagation Lifecycle

This model traces one complete replication cycle, synthesizing the adaptive-exploitation research with the inference-establishment research. Each stage depends on a distinct AI capability, and the cycle repeats from every newly compromised host.

The cycle is self-reinforcing: every successful pass adds infrastructure and a new launch point. Anthropic frames the defensive problem epidemiologically—pushing R₀, the number of new devices each infected device goes on to infect, below 1 so the replicator dies out.

AI-Driven Capabilities: Adaptive Exploitation

The first differentiating capability is how the worm gets in. Traditional malware ships with a pre-written exploit; if the target doesn't match its assumptions, the attack fails. The adaptive worm instead combines scripted execution with adaptive discovery: LLM agents perform structured problem-solving over what they observe about each target and generate attack strategies specific to it. In the CleverHans controlled experiment, a prototype powered by an open-weight LLM running locally propagated across a heterogeneous network of Linux, Windows, and IoT devices carrying common corporate network vulnerabilities.

This is the property that breaks the conventional patch response. Because the worm can reason about diverse vulnerabilities as it moves, there is no single flaw whose closure halts the outbreak. Palo Alto Networks' overview of AI worms describes the same general pattern from the defender's side: learning worms collect data from their environment, analyze failed penetration attempts, and adjust their methods, increasing their success rate over time. The CleverHans researchers add that their prototype can incorporate newly published vulnerabilities within hours of disclosure—compressing the timeline between a CVE becoming public and becoming weaponized.

Autonomous Inference Setup on Heterogeneous Hardware

The second capability is the one Anthropic calls the least studied: after gaining execution, the worm must get its own model running on a machine it has never seen. As Beam.ai's analysis of the experiment explains, that means choosing an inference stack, finding compatible packages, and debugging hardware quirks, "where one wrong turn is hard to recover from." This stage is what allows self-replication without specific datacenter access or pre-compiled payloads for every system type—the worm adapts its deployment to whatever hardware and operating system it finds.

It is also the worm's bottleneck. Reporting by Tom's Hardware on Anthropic's findings notes that a model-driven replicator could take days to establish an inference environment on a new host, whereas conventional malware executes its payload within seconds when its assumptions hold, and a conventional worm can reach tens of thousands of targets in minutes. Model weights also impose substantial bandwidth and storage costs. Anthropic acknowledges partial mitigants from the attacker's perspective: compromised hosts could download weights from external repositories rather than receiving them from an infected device, and not every compromised machine would need to host a model. Current deployment, in other words, is impractical—but the constraint is speed and cost, not possibility.

Defensive Challenges and Emerging Strategies

The researchers' own conclusions converge on a narrow but consequential point: patching loses its status as the primary defense. The CleverHans team argues that traditional worms can be stopped by patching the specific vulnerability they exploit, but their adaptive worm cannot, because it exploits diverse vulnerabilities as it propagates. Discovery alone is also insufficient without speed—automated CVE and patch verification, and the ability to forecast patch timelines, are critical for understanding the window of risk, which the prototype's hours-from-disclosure incorporation makes an urgent capability gap.

Containment therefore matters as much as prevention. The researchers highlight zero-trust architectures, which limit lateral movement after a foothold is established by requiring continuous authentication for every access request, and network micro-segmentation, which constrains the set of hosts reachable from any single compromised machine. These measures aim to starve the replication cycle of targets rather than to block a single exploit—matching Anthropic's framing of driving R₀ below 1.

Adapting Defenses to the AI Worm Threat

Organizations must move beyond traditional vulnerability patching and implement advanced containment strategies like zero-trust architectures and automated patch verification to counter AI worms. The evidence for this shift is structural: a worm that generates its own attack logic at runtime and establishes inference on unfamiliar hardware has no single point of failure to patch, so defense has to target the propagation cycle itself—cutting lateral movement between hosts and shrinking the interval between vulnerability disclosure and verified deployment.

Both research programs are proof-of-concept work in controlled environments, and the CleverHans authors intentionally withheld operational details to limit misuse risk. The measurable indicators to watch are the ones the researchers themselves define: a reduction in successful lateral movement attempts within networks, and a decrease in the time required for automated patch verification and deployment. If those two numbers fall while model-driven replication gets faster, the window of risk the researchers describe narrows from both directions.

Sources

• AI Agents Enable Adaptive Computer Worms — ARXIV
• AI models may be capable of self-replicating without access to a datacenter — Anthropic
• Self-Replicating AI: What Anthropic's Experiment Showed — BEAM
• Anthropic warns of self-replicating AI worm threat that doesn't need data centers… — Tom's Hardware