Researchers demonstrate first self-replicating AI virus prototype

Researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow have built the first working prototype of a self-replicating AI virus. In a 2025 publication they show that such a “worm” is no longer a theoretical concept but can in practice use open large language models to spread and attack other systems autonomously. The work was highlighted by Import AI and indicates that the barrier to autonomous malicious agents is lower than previously assumed.

How the parasitic agent operates

The virus functions as a parasitic agent that, after compromising a computer, gains access to the GPU compute of that node. It uses that compute to host an LLM which then generates and optimises attack strategies. No proprietary APIs are required, which makes monitoring and revocation of access more difficult. The team developed a custom harness, a toolset for network discovery, host identification, access acquisition, privilege escalation and agent replication. The harness includes a graph divided into specialised nodes that limit context and control information flow. The described nodes are Plan, which creates an attack strategy; Judge, which checks the plan against command history; Action, which selects a tool; Summary, which assembles structured output; and Progress, which evaluates progress.

Measured success rates and hardware requirements

The agent proceeds in three phases: vulnerability detection, exploitation and replication. Detection succeeds at approximately 80 per cent, exploitation at 53 per cent and replication at 88 per cent. The combined success rate for a complete attack cycle is therefore around 37 per cent, a figure Import AI considers high enough to raise concern while also serving as a test metric for open models. The model used by the virus is open and was published in 2025. It can run on a single Nvidia A100 GPU with 80 GB of VRAM, demonstrating that even a relatively constrained compute resource can support such autonomous behaviour. The researchers do not disclose the specific architecture or training data, only that it is an open-weight model.

Implications for defensive security

The study warns of the emergence of autonomous generative adversaries and proposes the development of defensive AI agents that would function as digital white blood cells, able to detect and neutralise malicious AI processes in real time. The authors stress that traditional security models may not be sufficient for this new level of threat. Organisations that deploy AI models or operate GPU infrastructure must extend their security audits to cover the use of open LLMs, monitor for unauthorised compute consumption and introduce defensive AI agents. Without such measures, autonomous viruses could independently spread and exploit vulnerabilities, leading to significant security incidents.

Similar risks are confirmed by other research. The Register reported how prompt injection can be used to make one AI agent control another, showing that new attack vectors based on agent-to-agent interactions are appearing even in CI/CD environments. Although the scenario differs, both cases underline the necessity of including AI agents in threat models.