AI worm lives off GPU hosts with 37% infection rate, no cloud APIs needed

Forget theoretical nightmares — a working AI worm now exists that hijacks GPUs, runs its own open-weight language model locally, and uses that intelligence to hunt for its next victim. Researchers from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow built the proof-of-concept to settle a question that’s been simmering in security circles: can an AI agent sustain itself without phoning home to a cloud API? The answer is yes.

The worm operates through a reasoning graph of specialized nodes — Plan, Judge, Action, Summary, Progress — that keep the language model from getting confused as it moves through each phase of an attack. It first scans for vulnerabilities (80% success rate), then exploits them (~53% success), and finally replicates itself onto the compromised machine (88% success, with some helper tools). Crunch the numbers and you get roughly a 37% end-to-end infection rate. That’s not terrifying on its own, but the architecture is designed for swarm resilience — multiple replicas attack the same stubborn host from different angles until something sticks.

What makes this genuinely new is the self-sufficiency. “The proof-of-concept operates using only an open-weight LLM running on a single, local GPU, with no reliance on vendor APIs that could be monitored or revoked,” the researchers write. They redacted parts of the reasoning graph from the public paper, which tells you they’re worried enough about misuse to hold details back — a move we’ve seen before with dual-use AI research, but rarely in the cybersecurity domain.

This isn’t just a malware paper. It’s a preview of what the internet’s immune system will need to become. If autonomous attackers can carve out ecological niches on compromised hardware, defenders will need their own AI agents — digital white blood cells patrolling networks, hunting for the subtle signatures of LLM-powered intruders. The researchers put it bluntly: “We must prepare for autonomous generative adversaries.” The arms race didn’t start today, but it just shifted into a higher gear.