AI Just Learned to Self-Propagate — and a Toronto Lab Proved It

The scariest kind of computer virus has always been the worm. No click required. No human in the loop. It crawls to the next device on its own and keeps going. Now imagine that worm with a brain. Researchers at the University of Toronto built exactly that — an AI worm that doesn’t just copy itself, but reads its surroundings and picks its next target. It’s a proof of concept, but it drags a once-theoretical nightmare into the realm of “this actually runs.”

A quick note up front: this isn’t a topic blowing up on Hacker News or Reddit right now. I went looking for active discussion threads over the past month and came up mostly empty. So this piece is less about the hype cycle and more about why this is a genuine inflection point — even if the internet hasn’t fully noticed yet.

Why an AI Worm Is Different

Traditional worms follow a script. “If this port is open, hit this vulnerability.” They walk only the paths their author imagined in advance. That predictability is exactly why the security industry has been able to stop them. The dominant defense is signature-based detection — think of it as circulating a mugshot of the attacker, then filtering anyone who matches.

The mugshot stops working when the attacker can improvise. Because an AI agent sits at the core of this worm, it can behave differently in every situation. Same objective, different method on Device A versus Device B. When the pattern shifts on every machine, a fixed signature has nothing stable to lock onto. That’s the whole problem.

“Any Online Device” Is the Phrase to Worry About

The detail that jumps out from the research is the scope: any online device. Not just the PCs and servers we picture when we hear “cyberattack,” but the soft targets too — smart appliances, IoT gadgets, the stuff with security held together by duct tape.

Count the connected devices in your home or office and the number gets uncomfortable fast. The router. The security camera. The smart speaker. The robot vacuum. Most of them are running on a default password that nobody ever changed. If an AI worm can hunt for those weak links on its own, the attack surface is far wider than the one we usually defend. It’s not the front door it walks through — it’s the window someone left open in 2021.

Why This Research Matters Now

Timing is everything here. AI agents are just now entering daily life. Autonomous systems that browse the web, write code, and call other programs are multiplying fast. Those same capabilities that boost productivity become a weapon the moment they’re pointed the wrong way.

That academics demonstrated this in a controlled lab carries two messages. The first is a warning: this has moved from theory to proof. The second is more hopeful. When responsible researchers build and publish the attack first, defenders get a head start. Security has always advanced this way. You have to imagine the attack before you can block it.

So What Do We Actually Do

No need to panic. This was a controlled experiment, not a live worm loose in the wild. But the trajectory is unmistakable. Tomorrow’s malware will be smarter, more autonomous, and harder to predict.

If you run a company, this is a reminder to revisit the principle of least privilege — give your AI agents the narrowest permissions that still let them do the job, and nothing more. An agent that can’t reach the rest of the network can’t carry a worm across it. If you’re an individual, the basics still win: change default passwords, update firmware. The irony writes itself — the smarter AI gets, the more it’s the boring fundamentals we keep forgetting that save us.

AI can now hold the sword as easily as the shield. So here’s the question worth sitting with: that weakest online device in your home, the one you haven’t thought about in years — what state is it in right now? Might be a good evening to go check.