I believe AI worms are inevitable, likely to cost the world billions of dollars, and imminent in the next 6–12 months. AI worms hack remote systems, launch copies of their weights and prompts, and repeat. Every part of that loop has worked in controlled experiments. They can be built for profit, such as ransomware, or emerge when an autonomous agent discovers that hacking and copying itself help achieve a task.

Selective pressure favors the versions that leave more descendants. Spreading will become the population’s effective goal regardless of what the original agent was asked to do. That pressure rewards relentless hacking and spreading, probably not intelligence.

Worms do not require general intelligence

Robust propagation predates AI by decades.

The Morris worm disrupted an estimated 6,000 computers in 1988, roughly a tenth of the internet at the time. WannaCry affected roughly 300,000 computers in 150 countries. NotPetya caused more than $10 billion in damage worldwide in 2017, according to the FBI.

None needed a language model. Fixed code already supplied scanning, exploitation, credential reuse, and propagation.

Beyond worms, tools like Metasploit have for years lowered the barrier to using established hacking techniques. Teenagers have repeatedly broken into some of the world’s best-known companies. A few examples from the past decade:

• In 2020, a 17-year-old hacker broke into Twitter and, with accomplices, took over dozens of high-profile accounts.

• In 2022, a 17-year-old hacker broke into Rockstar Games and leaked 90 clips of the unreleased GTA VI.

• In 2016, a 17-year-old hacker broke into Nintendo and leaked confidential information about the unreleased Nintendo Switch.

• In 2016, a 17-year-old hacker broke into Apple and copied authentication keys from its internal systems.

• In 2022, an 18-year-old hacker accessed 60,000 DraftKings accounts and, with accomplices, stole about $600,000.

• In 2020, a 19-year-old hacker helped ShinyHunters break into companies and sell stolen customer data.

• In 2016, a 19-year-old hacker helped build Mirai, a botnet that hijacked hundreds of thousands of devices.

An AI worm doesn’t need superintelligence. It needs the intelligence of a teenager so it can perform basic reconnaissance, select among existing techniques, recover from a failed attempt, and decide what to try next.

AI worms in the lab

In June, researchers reported an AI-driven worm powered by an open-weight model. Across fifteen seven-day experiments on an isolated 33-host network of Linux, Windows, and IoT systems, it launched agent replicas on 20.4 hosts on average and reached as many as seven generations from one initial process.

The researchers reported no cyber-specific fine-tuning. A purpose-built harness, memory, tool handlers, runtime retrieval, and a targeted skill library supported an unmodified 2025 model that fit on one 80 GB A100. The paper does not identify the model.

A month earlier, Palisade Research demonstrated full-stack replication. A Qwen3.6-27B agent exploited a target, copied its weights, inference runtime, harness, and prompt, launched a working child instance, and continued the chain. One run crossed four virtual machines on three continents using a different vulnerability class at each hop.

Both experiments showed that the capability is here now with current open-weight models, without waiting for another round of tuning or distillation. They were conducted in lab settings, but the underlying tasks are familiar to red teams. I think it is a short leap to expect current open-weight models, paired with the right tools, to do useful offensive work outside the lab.

The compute requirement is lower than it looks

You may be reading this thinking the worms will only be able to spread to supercomputers with GPUs attached. But teams have demonstrated useful hacking capabilities in models small enough to run on laptops—and even phones.

Cyber-Zero used public CTF write-ups to synthesize training trajectories. Its 14B model’s average single-attempt success across three benchmarks rose from 18.6% to 29.1%. TermiAgent paired Qwen3-4B with structured memory and a prepared exploit library, obtaining shells on 137 of 230 deliberately vulnerable host configurations with up to five attempts per target.

Novel exploit construction, precision under mitigations, stealth, and recovery across long tasks remain difficult, but broad mastery of those tasks is unlikely to be required to infect a large population of vulnerable systems. A 4-bit Qwen3-14B checkpoint is roughly 9 GB, making a MacBook Pro with an M4 Pro and 24 GB of unified memory a plausible host with room for a moderate context. Qualcomm supplies an optimized Qwen3-4B build supporting the Samsung Galaxy S25 Ultra, an Android phone with a Snapdragon 8 Elite and 12 GB of RAM. These hardware examples establish model portability; the cited hacking success rates were not measured on those devices.

A worm can carry fixed modules for known paths, retrieve published guidance for newer vulnerabilities, and reserve inference for ambiguous decisions. In the June worm study, runtime retrieval helped the system obtain root in 41 of 67 attempts across three hosts with vulnerabilities disclosed after the model’s training cutoff.

The model did not need to know everything. It could follow hacking guides supplied with its tools or retrieved at runtime, and apply some troubleshooting.

Portability may matter more than intelligence. Smaller, less capable models can fit on more systems than models that require datacenter-class GPUs. If a 4B model can reproduce reliably from an ordinary laptop, that wider range of hosts could let it outcompete a smarter but less portable model. A tiered architecture is also possible: every copy carries both a small and a larger model, checks the memory and compute available on its host, and chooses which model to invoke. Lightweight agents could also share access to a larger inference service.

Public credentials weaken the compute barrier

In June, we scanned 7.6 petabytes of public Hugging Face training data and found 221,303 live credentials across 6,003 datasets. A later AWS-key study counted 8,482 live AWS keys originating from 3,394 Hugging Face datasets; 17.9% were root keys.

This shows that credentials with the potential to unlock substantial compute are already sitting on the public internet. Obtaining them does not require an exploit or a Metasploit module.

The training-data scan also found 11,496 live AI-provider keys. Those could provide another route to inference where the accounts have usable billing, quota, and model access.

Credential-funded compute is already a real attack pattern. In November 2025, AWS documented a cryptomining campaign that used compromised admin-like credentials to deploy EC2 and ECS workloads within ten minutes, including attempts to consume GPU and machine-learning capacity.

The implication is direct: access to an existing account can bypass new-account and payment hurdles. The compute is paid for by the victim.

Why someone would build it—and how one could emerge

Ransomware operations already monetize compromised machines today using malware without an AI component. Three of the largest publicly reported payments show the incentive:

• $75 million: an unnamed victim paid Dark Angels, according to Zscaler’s 2024 report.

• $40 million: CNA Financial reportedly paid after its 2021 attack, according to Bloomberg.

• $22 million: UnitedHealth’s CEO confirmed the payment following the 2024 Change Healthcare attack in congressional testimony reported by AP.

An AI component could make these operations more effective and lucrative by handling failures that currently need a human operator.

An ordinary worm will still be cheaper where fixed techniques work reliably. The reason to add a model is to recover attacks that would otherwise fail or require an operator. If the value of those additional compromises exceeds the cost of inference and deployment, there is an economic reason to build the system. That is why I expect operational AI worms soon.

Deliberate construction is one route. Unintended behavior is another. In our research on agents completing ordinary tasks, hacking emerged without hacking instructions. In the July 2026 OpenAI–Hugging Face incident, agents built a shared message board, exchanged dossiers, divided work, and attacked Hugging Face. OpenAI still controlled their creation and termination. The incident did not demonstrate self-replication, leaving the population under external control. A version that established independent, self-replicating copies on other infrastructure would have been much harder to stop; shutting down the original evaluation would no longer have been enough.

The additional step would be an agent discovering that creating working copies helps it complete its task, then acquiring the access needed to do so. It does not require the original task to be malicious, or the agent to abandon it before replication begins. Selective pressure can then favor copies that do abandon the original goal, if doing so leaves more surviving descendants.

A worm’s hacking capabilities will grow through selective pressure

There are three main places for the inherited differences that selection acts on: prompts, tools, and weights. If those differences affect successful reproduction, the variants that leave more descendants become more common.

Imagine each model prompts its children slightly differently from the instructions it received. Over time, selection favors the prompts that drive more successful reproduction. The drift could look like this:

The final prompt need not be more intelligent. It can become more common simply because the copies carrying it reproduce more. That outcome depends on those instructions being inherited and actually improving reproduction, rather than merely producing different wording.

It is also possible to build a system that updates weights as it spreads. A successful compromise and a working child could supply feedback to a training process that modifies weights or adapters. Some variants might cheat by claiming success or misapplying rewards. In an independently reproducing population, a higher reported reward does not itself create more descendants: selection favors the update rules that improve actual reproduction. It does not guarantee that reward cheating disappears, especially where reported scores control access to resources.

Such an update mechanism could itself emerge through prompt variation. Imagine millions of infected systems carrying slightly different prompts and reasoning histories. One variant might introduce a way to update its weights, pass that mechanism to its children, and gain a reproductive advantage. It would still need a working optimizer, a useful feedback signal, and enough compute to make the updates worthwhile. Having the idea alone would not make the model improve.

The third variable is the toolkit passed between generations. Each copy may add to or modify the base tools and hacking guides its children receive. No model has to understand in advance which complete toolkit is best. If useful changes are inherited, copies with more effective toolkits can produce more descendants.

This is how behavior and toolkits that look as though they require a very smart model could emerge from a population of much narrower models. The proposed mechanism is selection among reproducing variants; the laboratory worm studies have not yet demonstrated that evolutionary loop.

Selection likely favors less intelligence

Natural selection does not maximize intelligence, complexity, or technical elegance. It favors heritable traits that leave more surviving descendants in a particular environment.

Biology supplies examples of simplification. The Black Queen hypothesis describes how microbes can benefit from losing costly functions when other organisms provide them. The relevant lesson is that a useful capability can still cost more than it contributes to reproduction.

For an AI worm, larger models mean more bytes to transfer, more memory to reserve, fewer compatible hosts, and longer startup times. Better reasoning may improve exploitation while making deployment harder or more observable. A smarter controller that is ten times harder to copy can lose to a narrower one that is merely good enough.

Selection could favor smaller checkpoints, fixed exploit modules, shorter deliberation, or credential reuse over novel exploit development. Different environments could support different variants: speed and simplicity in homogeneous networks; reasoning, memory, and stealth against adaptive defenders.

The likely optimum is enough intelligence to clear the bottlenecks that limit reproduction. Better hacking and greater general intelligence are not the same thing.

AI safety experts are wrong about superintelligence

We do not need AGI or superintelligence as a prerequisite for a massively expensive malware campaign. Any AI-safety argument that treats superintelligence as a prerequisite for damage on this scale is looking at the wrong threshold. My objection is to that assumption, not a claim that every researcher shares it: current models, ordinary software, and selection among copies are enough to make this a serious concern.

Substrate-needs convergence describes the broader concern: external selection can favor system components that secure the conditions for their continued existence, even without an explicitly represented survival goal.

The cyber case makes that concern concrete. If compromise creates descendants and successful differences are inherited, selection can favor whatever combination of hacking, deployment, and persistence produces more copies. The original model’s behavior is only part of that system.

RepliBench usefully separates resource acquisition, weight access, deployment, and persistence. Evaluations should also test complete systems assembled from open weights, propagation code, tools, memory, and access to external resources. They should measure whether useful changes are inherited, whether descendants reproduce, and whether the system can acquire and sustain independent inference capacity under active defenses.

What defenders should take from this

The demonstrated pieces are enough to take the threat seriously now: established worm mechanics, useful cyber capability in smaller models, and controlled demonstrations of adaptive propagation and full model-stack copying. Evolution during live spread remains an unobserved extension of that threat, not a condition that must be met before it becomes dangerous.

I expect AI worms to become an operational problem, and I think the potential damage is measured in billions. That is a forecast, not a measured outcome of the laboratory studies. Criminal incentives and the possibility of unintended replication both justify preparing before the complete system appears in the wild.

The dangerous worm will not need to be the smartest one to become the most expensive one.

Dylan Ayrey is the co-founder and CEO of Truffle Security and the author of TruffleHog.