Autonomous Malware Is No Longer Theoretical

InnovationEnterprise TechAutonomous Malware Is No Longer TheoreticalByForrester,Contributor.Follow AuthorJun 15, 2026, 09:30am EDTAutonomous Malware Is No Longer TheoreticalForresterEarlier this month, security researchers published a paper about the creation of an AI worm. The headline is as subtle as a fire alarm: This lab experiment of a worm is no longer just code that blindly crawls across your environment; it leverages AI models and can now reason, execute, and learn in complete autonomy. This is certainly not the first lab-created malware. We have seen experimental or proof-of-concept worms before, from Creeper and Reaper to the Xerox PARC worms, the Morris worm, and Cabir. But the Morris worm remains the cautionary tale with teeth. It was created by Robert Tappan Morris (released in 1988), and it rapidly became one of the internetwide disasters that helped make the need for security norms, regulations, and laws governing the internet perfectly clear. This latest research opens a whole can of worms (pun intended). The researchers used publicly available open-weight AI models to demonstrate an autonomous worm capable of discovering and exploiting vulnerabilities while spreading laterally across the network. Thankfully, the work was conducted in an isolated lab environment and was disconnected from the internet. The implications of this research finding become hard to ignore as security leaders prepare for handling autonomous threat operations. Experts must grasp the following: The economics of AI-enabled threat activity become more complex. Recent headlines around Anthropic’s Claude Mythos Preview and OpenAI’s Daybreak have caught the attention of security practitioners, business leaders, and governments. This research on AI worms, however, pushes the conversation somewhere more uncomfortable as it expands the scope toward the use of small open-weight models for offensive security use cases. Additionally, in such attack vectors, the victim’s infrastructure bec...