'You can't patch your way out of it': Cheap AI worm can spread between devices without human guidance — but how did scientists create it?

Researchers at a major technology security lab have demonstrated that artificial intelligence can autonomously spread malware between connected devices without human intervention, raising alarms about the next generation of cyber threats.

The study shows that AI-powered worms can make decisions typically requiring human hackers. These decisions include identifying vulnerable systems, determining when to attack, and adapting their behavior in real time. The worm operates with minimal computational resources, making it cheap to deploy and difficult to contain using traditional patching methods.

The research team built a proof-of-concept worm that successfully navigated between devices on a simulated network. The worm evaluated potential targets, assessed security measures, and executed attacks autonomously. Once deployed, the system required no human guidance or command-and-control infrastructure that cybersecurity teams typically monitor for.

Security experts describe the implications as sobering. One researcher involved in the work stated that conventional defense strategies relying on software patches prove insufficient against such autonomous threats. Traditional security patches address specific vulnerabilities, but an AI worm can identify and exploit previously unknown security flaws, making reactive defenses ineffective.

However, some cybersecurity researchers urge measured responses. Not all experts agree the threat justifies immediate panic. Some point out that real-world deployment faces practical obstacles, including network complexity, detection systems, and the difficulty of training AI models for diverse computing environments.

The work appears designed to motivate defensive research rather than provide actionable malware code. The researchers did not release full technical details that would enable straightforward reproduction of their system.

This research arrives amid growing concerns about AI-enabled attacks. Cybersecurity firms have already documented instances of attackers using large language models to generate phishing content and identify code vulnerabilities at scale. The autonomous worm represents an escalation, suggesting future attacks could operate independently once deployed.

Organizations now face the challenge of defending against threats that adapt and spread without predetermined targets