U of T researchers demonstrate AI worm could target any online device | University of Toronto

Skip to main content

Campus status

Search the U of T website

Search

Search the U of T website

Search

Campus status

Navigation

U of T News

Follow U of T News

U of T researchers demonstrate AI worm could target any online device

The research was conducted in a secure digital lab with the goal of helping the cybersecurity community prepare for an imminent threat

Researcher Nicolas Papernot and his collaborators showed that publicly accessible AI models can be used to power a worm that adapts its strategy as it spreads (photo by Nick Iwanyshyn)

Published: June 2, 2026

By<br>Adina Bresge

A team of researchers at the University of Toronto has discovered a new class of cyberthreat that gives hackers more power and reach at far less cost. It can be built with free AI models. Every online device is a potential target. And current cyber defences are not yet ready for it.<br>The researchers, who released their work June 2, are believed to be the first to show that publicly accessible AI models can be used to power a worm that adapts its strategy as it spreads from one device to the next. It can seize control of an entire network and hijack computing power to allow hackers to launch sophisticated attacks at virtually no cost.<br>Conducted in a secure digital lab walled off from the outside world, the research shows that highly skilled hackers don’t need cutting-edge AI or deep pockets to unleash malware capable of learning, calculating and pivoting in real time – exploiting known vulnerabilities in each device as it proliferates across a system.<br>The findings raise profound concerns about the security of our interconnected world – from financial systems to hospitals to the networks underpinning critical services.<br>“It was imperative for us to understand this threat in a controlled, academic setting before bad actors figured it out for themselves,” says Nicolas Papernot , who authored the research alongside members of his CleverHans Lab located at U of T and the Vector Institute, where he is a Canada CIFAR (Canadian Institute for Advanced Research) AI Chair.

Papernot – who is also an associate professor of computer engineering in U of T’s Faculty of Applied Science & Engineering and computer science in the Faculty of Arts & Science – added that the research was shared only after careful scrutiny to remove any information that could aid threat actors, noting it is well understood that such are efforts are underway behind closed doors. He says he felt compelled to go public as early as possible to give researchers, policymakers and the general public a chance to protect themselves against an emerging threat that stretches from everyday laptops to HVAC systems and the energy grid.<br>Before publishing, the researchers shared their findings with national science, security and defence bodies and sought advice on how to responsibly release the information.<br>“The reason we are doing this research is to ensure the security of the digital ecosystem we all rely on – to keep people safe. This finding catapults us into a new era of cybersecurity,” says Papernot, a faculty affiliate at U of T’s Schwartz Reisman Institute for Technology and Society, which focuses on ensuring AI is responsible, inclusive and beneficial for everyone.<br>“By understanding the risks, we are now positioned to develop the countermeasures needed to detect and defend against threats like this.”<br>Underestimated threats<br>One of the world’s leading cybersecurity experts, Papernot has made it his lab’s mission to anticipate the security concerns that matter most – even the ones the cybersecurity community isn’t paying attention to yet.<br>The rise of the most powerful AI models like Anthropic’s Claude Mythos has sparked widespread alarm over their unprecedented capacity to unearth hidden security flaws, even as big-tech players maintain tight controls to prevent misuse.<br>Papernot’s team, however, was interested in the potential misuse of smaller, relatively simple models that anyone can download and modify for free. While valuable for researchers and developers, these “open-weight” AI models can be stripped of their safety guardrails and, with enough technical knowledge, manipulated to do harm.<br>This risk is often downplayed on the assumption that these models lack the power to do real damage. So, Papernot’s team decided to put that assumption to the test in a safe, academic setting.<br>Building a prototype<br>A worm is a digital invader that crawls through a network, copying itself onto every device it touches – no clicks required and without users’ knowledge. If it takes root, it can wreak havoc across an entire system. Traditionally, this type of attack follows a fixed script programmed by a human. If it hits a defence it wasn’t programmed to crack, it fails. Cybersecurity experts know this and have built protections to contain such threats.<br>For their AI-powered version,...