University of Toronto Develops Advanced AI Worm: What It Means for Cybersecurity
Researchers from the University of Toronto have created a groundbreaking AI worm that can smartly adapt and target specific vulnerabilities in devices using open-source technology. This new worm is different from traditional ones, which simply replicate themselves by exploiting known security flaws.
For example, the infamous WannaCry worm exploited a vulnerability in older versions of Windows, impacting about 10% of internet-connected systems in the U.S. in just one day. Luckily, organizations could patch those vulnerabilities fairly easily. However, the new AI worm identified by the Toronto researchers takes a different approach. It is capable of independently locating security weaknesses and creating customized attack strategies in real time by utilizing large language models.
In their recent research, the team developed a proof-of-concept (POC) AI worm that can autonomously identify and exploit these vulnerabilities. It cleverly uses the computing power from infected machines to sustain itself, making the cost for attackers virtually zero while significantly impacting the victims.
The researchers tested this AI worm in a controlled environment that simulated a corporate network with various devices, including Linux, Windows, and IoT systems. They found that within just a week of autonomous operation, the worm managed to exploit around 73.8% of the test network.
What Should Cybersecurity Leaders Know?
Cybersecurity leaders, including Mike Wilkes, CISO at Aikido Security, are aware that if defensive strategies are being developed, attackers are likely working on similar tools. While they view this new threat as serious, there’s no need for panic.
Trevor Horwitz, CISO at TrustNet, points out that AI worms aren’t a completely new risk but rather an evolution of existing challenges like automated malware and poor identity controls. He emphasizes that real-world corporate networks are often messy, making it unlikely for this type of AI worm to spread as easily as in a lab setting.
Horwitz suggests that attackers might employ AI to enhance various aspects of their strategies—such as reconnaissance and phishing—rather than launching fully autonomous worms.
Martin Reynolds, a field CTO at Harness, agrees, noting the importance of understanding the increased speed and adaptability that AI affords attackers. This means they can exploit the same weaknesses security teams have been dealing with for years.
How to Protect Against AI Worms
The Toronto researchers noted that the AI worm can only exploit known vulnerabilities. However, with internet access, it could quickly absorb updated information about newly found vulnerabilities, allowing it to strike before organizations can patch those flaws. During their tests, the worm was able to exploit vulnerabilities based on recent public advisories, even without prior training.
Essentially, AI worms don’t need advanced capabilities to be dangerous; they can take advantage of existing weaknesses, such as poor passwords or misconfigurations. Wilkes warns that these areas are where many large companies often fall short, due to outdated systems and unmanaged devices.
He advises organizations not to invest in overly complex anti-AI malware products. Instead, they should focus on solid cybersecurity fundamentals, as traditional security measures are still effective against these new AI-driven threats.
Horwitz echoes this sentiment, stating that while AI might increase the cost of poor execution, it doesn’t make fundamental security controls any less relevant. Simple, robust security practices remain crucial in defending against these evolving threats.
