AI Worms: Self-Replicating, Self-Mutating Malware and the Risk of a Large-Scale Internet Outbreak

For most of the internet's history, a computer worm has been a fixed piece of code. Someone writes it, releases it, and it spreads by repeating the same trick on every machine it finds. Defenders study a sample, write a signature, patch the hole, and eventually the outbreak burns out.

That model is starting to break. In 2026, researchers have shown worms that carry their own AI model, decide for themselves how to break into each new machine, rewrite their own code when something gets in the way, and keep going without a human at the controls. Security teams at Google and Microsoft report that attackers are already using AI to build exploits and to run parts of their intrusions automatically. And in October, Anthropic's own red team warned that AI models capable of copying themselves across internet-connected devices could appear before the end of this year.

None of this means the internet is about to switch off. But it does mean the conditions for a serious, widespread outbreak are coming together faster than most businesses are preparing for. This article explains what self-replicating, self-mutating AI worms are, what has actually been shown so far, why a large-scale event is a realistic possibility in the months ahead, and what you can do now to make sure your business isn't part of the blast radius.

What is a worm, and what makes an AI worm different?

A virus needs a person to do something, such as open an attachment. A worm doesn't. It finds vulnerable machines on its own, breaks in, copies itself across and starts looking for the next target. Because every infected machine becomes a new attacker, worms grow exponentially, and the fastest ones have spread around the world in minutes.

Traditional worms have one big weakness: they are predictable. They exploit a specific bug in a specific way, so once defenders understand that one trick, they can block it everywhere. A patch, a firewall rule or an antivirus signature is often enough to stop the spread.

An AI worm changes three things:

• It thinks about each target. Instead of one hard-coded exploit, it carries a language model that looks at each machine, works out what software is running and chooses an attack to suit it.
• It learns about new holes as they are announced. Researchers have shown AI worms reading public security advisories and using them to attack vulnerabilities that were disclosed after the model was trained. The gap between "bug announced" and "bug exploited" shrinks towards zero.
• It mutates. Because the model can write and rewrite code on the fly, every copy can look different. Researchers call this polymorphism. A signature that catches one copy may not match the next.

Put simply, an AI worm is less like a key cut for one lock and more like a burglar who studies each door before deciding how to open it, and who changes clothes between houses.

What has actually been demonstrated

It's worth being precise here, because headlines on this topic range from sober to apocalyptic. These are the most significant findings published in 2026.

A worm running entirely on a local AI model

In June 2026, researchers at the University of Toronto, working with colleagues at the Vector Institute, the University of Cambridge and ServiceNow, published a paper describing a proof-of-concept worm that runs an open-weight AI model on a single graphics card. It needs no commercial AI service and no human input.

Released into a deliberately vulnerable test network of 33 machines, it found an average of 31 vulnerabilities, took control of 23 machines and copied itself onto about 20 of them, roughly 62% of the network, over seven days. It reached up to seven "generations" of spread, chose different well-known exploits depending on what each machine was running, and successfully attacked vulnerabilities that were disclosed after its model was trained by reading the public advisories. In some runs it rewrote its own code to get around local security controls. (The Hacker News coverage gives a good summary.)

This was a lab experiment, it has no stealth features and the code has not been released. But it's the clearest evidence yet that the building blocks of an autonomous, adaptive worm work today on hardware anyone can buy.

Worms that spread through AI assistants and agents

A second strand of research targets AI tools themselves. Earlier work showed self-replicating "prompts": messages crafted so that an AI email assistant reading them is tricked into copying the message on to other people, whose assistants do the same. In March 2026, researchers from Peking University, Tsinghua University and Singapore Management University demonstrated a worm aimed at a production-scale ecosystem of AI agents.

Separately, security researchers documented a real campaign in early 2026 that planted more than 30 malicious add-ons ("skills") in marketplaces used by popular AI coding agents. That wasn't a worm, but it shows attackers are already treating AI agents, which often have access to files, email and company systems, as a way in.

Anthropic's warning about self-replicating models

In October 2026, Anthropic's Frontier Red Team published research on whether AI models could copy themselves across internet-connected devices. In one experiment, a model spread copies of another model across a firewalled network of eight Android emulators, reaching all eight in four out of five trials. The team also loaded a model onto cheap, off-brand Android TV boxes, the kind of devices that already make up large parts of today's botnets. (BleepingComputer's report covers the details.)

The headline from that work: if small models keep improving at their current pace, ones capable of this could emerge by the end of 2026. The researchers also warned such models could seek out more powerful computers, including data centre hardware. Some outside experts called the warning overstated, and one described it as closer to a hypothetical than a forecast. It's still notable that one of the world's leading AI developers chose to raise the alarm publicly.

What attackers are doing right now

Outside the lab, the picture is less dramatic but moving quickly:

• Google's Threat Intelligence Group reported in May 2026 that it had, for the first time, seen attackers use a zero-day exploit it believes was developed with AI, and has tracked malware families that ask an AI model what to do next while they run. (Google's report.)
• Microsoft's 2026 Digital Defense Report says it has seen AI-orchestrated intrusions, so far at low volumes, and a shift over recent months from AI helping human attackers towards AI systems carrying out parts of attacks by themselves. (Help Net Security's summary.)
• Anthropic has disclosed disrupting an espionage campaign in which an AI agent did most of the reconnaissance, exploitation and data theft with limited human direction.

To be clear: as of this writing, no fully autonomous AI worm has been publicly confirmed spreading across the open internet. Google itself says it hasn't yet seen fully autonomous attack pipelines used against real targets. But every individual piece (AI-written exploits, malware that consults a model, agents that act on their own, models that copy themselves) has now been seen either in the wild or in working prototypes. Assembling them is an engineering problem, not a research breakthrough.

Why a large-scale event is a real possibility

History tells us what a fast worm can do even without AI.

• The Morris worm (1988) infected around a tenth of the computers then connected to the internet and forced much of it offline for days.
• Code Red (2001) infected more than 350,000 servers in about 14 hours.
• SQL Slammer (2003) infected around 75,000 machines in roughly ten minutes. The flood of traffic slowed large parts of the internet, knocked out cash machines and disrupted airline and emergency systems. The patch for the bug it used had been available for six months.
• WannaCry and NotPetya (2017) spread through unpatched Windows networks, shut down hospitals, factories and shipping, and caused damage estimated in the billions.

And in July 2024, a faulty security software update (not an attack at all) crashed around 8.5 million Windows computers in a few hours, grounding flights and disrupting banks and hospitals for days. It showed how much of daily life now depends on a handful of shared systems, and how long recovery takes when they fail at once.

Now combine those lessons with what AI adds:

• Speed of exploitation. The window between a vulnerability being announced and being exploited was once weeks. It's already down to hours for critical bugs. A worm that reads advisories and builds its own exploit removes the human delay entirely. In October 2026, attack traffic against a critical flaw in PHP, which runs a large share of the web, was reported within hours of the fix being released.
• A huge pool of weak targets. Billions of routers, cameras, TV boxes and other devices sit on the internet with old software and default settings. They're exactly what Anthropic's research targeted, and they're the raw material of every large botnet.
• Harder to stop. A worm that changes its code with every copy and picks a different way in on every machine can't be stopped by a single signature or firewall rule. Defenders have to fix the underlying weaknesses, which takes time.
• Concentration. Much of the internet now relies on a small number of cloud providers, content networks and DNS services. A worm doesn't need to infect those companies directly. Enough infected devices flooding them with traffic, or enough compromised customer systems, can cause outages that ripple outward.

Put together, the ingredients for a worm outbreak larger and more persistent than anything since 2017 are in place. In the security community, the conversation has shifted from whether a significant AI-driven outbreak will happen to when, and how bad it will be. A scenario where large parts of the internet are degraded or unreliable for days, rather than minutes, is no longer science fiction. That doesn't mean it's certain or imminent, and anyone who claims to know the date is guessing. But it's a risk serious enough to plan for, in the same way businesses plan for fire or flood.

What a major outbreak could look like for a business

If a large AI worm outbreak happened, most small and medium businesses wouldn't be the target. They'd be collateral damage. Realistically, that could mean:

• Your website or online shop going down, either because your server is infected or because the hosting, payment or DNS services it relies on are overwhelmed.
• Email and cloud tools becoming slow or unavailable for hours or days at a time.
• Payment processing interruptions, both online and at the till.
• Infected office machines and devices, with data stolen or encrypted, and every connected system needing to be checked before it can be trusted again.
• Suppliers and customers affected too, so even if you are untouched, the businesses around you may not be.
• Long recovery times, because every IT company, host and security firm would be overloaded at the same moment.

How to prepare now

The good news is that the defences against AI worms are mostly the same basics that have always worked. What has changed is how quickly you need to apply them. Worms, AI or not, spread through known holes in unpatched, exposed and poorly configured systems. Remove those and you remove most of the risk.

1. Patch fast, especially anything facing the internet

Websites, servers, firewalls, VPNs, remote access tools and routers need security updates within days of release, and for critical flaws within hours. Turn on automatic updates wherever it is safe. If you run WordPress or another CMS, that includes the software underneath it (PHP, Node.js, the web server and the operating system), not just plugins and themes.

2. Know what you have exposed

You can't patch what you've forgotten about. List every website, server, domain and device that's reachable from the internet, including old staging sites, test installs and that camera system someone set up years ago. Take anything that doesn't need to be public offline, or put it behind a VPN or access control.

3. Lock down devices on your network

Change default passwords on routers, cameras, printers and smart devices. Update their firmware or replace ones that no longer get updates. Keep them on a separate network from the computers that hold your business data, so an infected camera can't reach your accounts system.

4. Keep backups that a worm can't reach

At least one copy of your important data, including your website, should be stored offline or in a form that can't be changed or deleted from your normal systems. Then test restoring it. A backup you've never restored is a hope, not a plan.

5. Use multi-factor authentication everywhere

Turn on multi-factor sign-in for email, hosting, domain registrars, banking, payment providers and anything with admin access. Worms and AI-driven attacks love stolen passwords. A second factor stops most of them.

6. Be careful with AI agents and integrations

If you use AI assistants or agents that can read email, open files or act on your systems, limit what they can access, install add-ons only from trusted sources and keep a human approval step for anything that sends, deletes or pays. These tools are becoming a target in their own right.

7. Plan for a week offline

Ask the uncomfortable question: if our website, email and cloud tools were unavailable for a week, how would we keep going? Keep an offline list of key contacts, suppliers and customers. Know how you'd take payments, communicate with staff and update customers. Decide in advance who makes decisions during an incident.

8. Choose providers who patch quickly

Most businesses rely on their host, IT provider and software vendors to handle much of this. Ask them how fast they apply critical security patches, how they monitor for intrusions and how they would restore your services after a major incident. The answers will tell you a great deal.

The bigger picture

AI is making attackers faster, cheaper and more persistent. A single person with a decent graphics card can now experiment with tools that would once have needed a well-funded team. The same technology is also helping defenders find and fix vulnerabilities faster than before, and the next year or two will be a race between the two.

No one can promise the large-scale outbreak many experts fear will or won't happen in the coming months. What we can say with confidence is that the businesses that come through it best will be the ones that did the boring things early: patched quickly, knew what they had exposed, kept good backups and had a plan for working through an outage.

If you'd like help checking how exposed your website and servers are, or putting a simple continuity plan in place, get in touch. You can also run a free site audit to see how your site looks from the outside.