A new study shows that computer malware powered by easily accessible artificial intelligence models is here—the research is a “wake-up call” to take cybersecurity risks from AI more seriously, one expert says.
In the study, researchers created an AI-powered computer “worm” designed to attack and spread between devices—revealing a threat that they say the world is woefully underprepared to fight.
“Our results demonstrate that self-sustaining AI-driven cyber-threats are no longer theoretical,” the researchers wrote. The paper, first reported by the New York Times, was posted on the preprint server arXiv.org and has yet to be peer-reviewed.
On supporting science journalism
If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.
David Lie, a professor at the University of Toronto, who is familiar with the research but was not directly involved with the study, says the work is a “wake-up call” that should inspire cyber experts and researchers to develop countermeasures to AI-boosted bugs as fast as possible. “The demonstration here is that there’s a motivation to do this sooner rather than later,” he says.
To make the “worm”—a form of malware that spreads between devices autonomously—the researchers didn’t rely on proprietary AI models from companies such as Anthropic or OpenAI, both of which have issued warnings about the threat of their technology being used by bad actors. Instead the researchers used an undisclosed but freely available AI model “that anyone can download off the internet,” they wrote in a post on their lab’s website.
Importantly, the prototype bug was created in an isolated virtual environment—so it isn’t going to be infecting any computers. Still, AI-powered worms are especially dangerous because they don’t attack a single weakness within a computer system, Lie says. Pre-AI worms were only able to follow certain instructions from their designer, he says, but “because this is AI powered, it can learn.”
The findings, the study’s authors say, raise serious cybersecurity concerns. “This research uncovered a new cybersecurity threat the world is not prepared to face,” they wrote in the same post. “With almost every aspect of modern life dependent on networked computers—drinking water and waste management systems, access to food and goods, energy, our financial system, communications, health care, education, transportation systems, government and so much more—the risk is enormous.”
The good news, Lie says, is that this technology is “dual use.” AI might enable a worm to learn as it spreads, finding and attacking hidden vulnerabilities, but AI can help fix these shortcomings, too, he says. “They’re mirrors of each other.”