IA open-weight creates business worm that spreads itself on corporate networks

Researchers at the University of Toronto have created a self-propagating cyberworm that exploits vulnerabilities in corporate networks, using an open artificial intelligence model of 2025 as an attack engine. malware operates in a single GPU and dynamically adapts to the environment, generating real-time exploits to compromise new systems. The discovery was published by the [LetsDataScience.com] (https://letsdatascience.com/news/open-weight-model-powers-self-spreading-enterprise-worm-5792edbd) portal and sparked warnings about the risks of AI democratization.

How does the AI worm use the open-weight model to spread?

The worm uses the open-weight model as an intelligence core to analyze the target network, identifying weaknesses as outdated software, poorly configured services, or authentication failures. From this analysis, automatically generates custom attack code and executes the invasion. Once inside, it moves sideways to infect new hosts, repeating the cycle without human intervention. All this runs in a single GPU, making the tool accessible even for groups with limited features.

Why is the AI worm lighting cybersecurity alert?

The demonstration proves that open AI models, often celebrated for democratizing access to technology, can also be double-sided weapons. Unlike traditional malware, which follow fixed sequences, this worm adapts in real time to each network it finds. Open-weight nature allows anyone to download and modify the model without central supervision. While companies like Google launch open models such as Gemma 4 12B to run on common laptops, the same type of technology can be reused for malicious purposes. The researchers themselves highlighted the need for ethical barriers, but the experiment shows that the line between innovation and risk is tenuous.

What can Brazilian companies learn from the AI worm?

For companies in Brazil, the alert is clear: the security of corporate networks needs to evolve to face threats based on AI that adapt dynamically. Traditional firewalls and detection systems may not be enough against a worm that creates new invasion methods with each attempt. The Brazilian market, with many small and medium-sized companies running legacy systems, is especially vulnerable. Investing in continuous monitoring, network targeting, fast patch update policies and zero-confidence architecture (zero-trust) becomes increasingly critical.

Frequently Asked Questions about AI worm

Can the worm infect any corporate network?

The worm was created in a controlled environment to explore common vulnerabilities in corporate networks, but its effectiveness depends on the configuration and protections in each system.

Is it possible to protect yourself against this kind of attack?

Yes, with practices such as regular software upgrade, network targeting, use of advanced firewalls and AI anomalies-based detection systems.

Is the model used publicly available?

Yes, the open-weight model used in the experiment was launched in 2025 and is available for download, which raises concerns about its use by malicious actors.