For months, the security community has been nervously watching what the most powerful AI models might do in the wrong hands. New research suggests we've been looking in the wrong direction.

Researchers have built a self-replicating AI worm that runs entirely on free, open-source language models — no GPT-4, no Claude, no Gemini required. The worm can propagate across enterprise networks, adapt its attacks on the fly based on what it encounters, and chain together known vulnerabilities in ways that would previously have required a skilled human operator sitting at a keyboard.

The key finding, as the researchers put it bluntly: "Attackers can now cheaply operationalize known vulnerabilities at scale." That's the part worth sitting with. This isn't about a nation-state with a classified AI stack. It's about a commodity capability that anyone with a laptop and an internet connection can replicate today.

How it works

The worm couples a lightweight LLM — the kind you can run locally on consumer hardware — with a set of automation scripts. The model doesn't need to be brilliant. It just needs to be good enough to read system responses, pick the right next move from a known playbook, and rewrite its own delivery mechanism to dodge detection. Think of it less like a genius and more like a very persistent, very patient intern who has memorised every CVE published in the last five years.

The researchers tested it in an isolated enterprise-style network. The worm propagated successfully, adapted when initial attack vectors were blocked, and did so without any human guidance after the initial launch.

Why this matters now

This research lands the same week that separate reporting confirmed attackers are already using AI to automate EDR evasion testing — running malware samples against Sophos, CrowdStrike, and Windows Defender in automated loops until something sticks. The pattern is consistent: AI isn't replacing attackers, it's removing the bottleneck of human time and skill.

The traditional defence assumption has been that scale costs money. A human attacker can only probe so many systems per hour. AI worms, even dumb ones, break that constraint entirely.

What defenders should do

Network segmentation and patch velocity matter more than ever. If a worm can only reach a handful of systems before hitting a boundary, the blast radius stays manageable. The research team specifically noted that the worm thrives in flat, poorly-segmented networks where lateral movement is easy.

For Australian organisations, this is directly relevant to the ACSC's Essential Eight guidance on patching and restricting lateral movement — both of which this worm explicitly exploits when they're neglected. The SOCI Act's critical infrastructure obligations around network resilience deserve a fresh look through this lens too.

What to watch

The researchers have responsibly disclosed their methodology without releasing the full code. But the honest assessment is that anyone with moderate skill could reproduce this from first principles — the tooling is all public. The question isn't whether someone will build this in the wild. It's whether defenders move faster than the commodity threat curve is rising.