Researchers build a self-replicating AI worm that hijacks GPUs

Import AI's latest issue leads with a proof-of-concept AI worm built by researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow. The worm compromises a machine, then uses that machine's own GPU to run inference on an open-weight large language model (published in 2025 and small enough to fit on a single A100 GPU with 80GB of VRAM), reasoning about how to find and exploit further vulnerable hosts and replicate itself onto them. It relies on no external vendor API, so there is nothing to monitor or revoke to stop it. A custom harness gives the model helper tools for network discovery, exploitation and replication, plus a 'reasoning graph', a directed graph of specialized nodes such as Plan, Judge, Action, Summary and Progress, that keeps the model's context focused on one sub-task at a time (the paper describes five of these nodes publicly and redacts the rest). In testing, the worm succeeded at vulnerability detection about 80% of the time, at exploiting a found vulnerability about 53% of the time, and at self-replicating 88% of the time, for a full attack-chain success rate of roughly 37%. The authors write that the result demonstrates 'self-sustaining AI-driven cyber-threats are no longer theoretical' and that 'we must prepare for autonomous generative adversaries.' Because replicas operate independently across the network, no single point of control can be taken offline to stop the spread; struggling replicas are simply retried by others sampling a different approach.

The issue's second item is an argument from Dwarkesh Patel that AI compute will get more, not less, expensive as models improve. Patel writes that 'as AI models become smarter, they'll better monetize the same amount of compute,' and estimates that a true human-level AI software engineer running on an H100-equivalent GPU should, at current software-engineer market rates, rent for over $250,000 a year, about 15 times today's spot GPU prices. He frames today's comparatively cheap AI as a temporary state of affairs tied to what models still cannot do, expecting prices to fall again only once large-scale robotization of the compute supply chain brings hardware costs down closer to the price of raw materials.

Third, roughly 1,337 employees signed a public statement carrying senior representation from all the major Western AI labs, OpenAI, Anthropic, Google DeepMind, Thinking Machines, Meta and Safe Superintelligence Inc among others; the signatories include chief scientists and cofounders of Anthropic, Google and OpenAI, as well as the CEOs of Safe Superintelligence and Anthropic. The statement asks the US government to support an international effort to 'develop the technical and governance tools needed to deliberately pace the frontier of automated AI development.' The statement argues that leading AI companies believe they could be close to automating AI research itself, that this is hard to forecast precisely, and that competitive pressure keeps any single company or country from unilaterally slowing down even if it wanted to.

The fourth item reports a 'shadow evaluation' study run by researchers from Princeton University, Cornflower Labs, the UK AI Security Institute, the University of Toronto, UC Berkeley, Georgetown University's CSET, Johns Hopkins University, the Golden Gate Institute for AI, AI Digest and Stanford University. The team partnered with the authors of two unpublished papers submitted to NeurIPS 2026 and had a frontier agent, Claude Opus 4.8 running inside the OpenClaw harness, attempt to answer each paper's central research question from scratch: one on the structure and controllability of LLM personas, the other on designing a distribution-shift detector for tabular foundation models. The original human authors then graded the agent's output as they would a conference submission. Both were rejected: the personas paper scored a 2 ('Reject') and the TabPFN paper a 1 ('Strong Reject'), with both reviews citing poorly motivated experiments, no novel contribution and impenetrable prose. The researchers conclude that today's agents can solve the engineering problems research requires but still cannot produce work at the caliber of a top ML conference.

Key facts

Researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow built a proof-of-concept AI worm that runs an open-weight LLM (published in 2025, fits on a single 80GB A100 GPU) on the machines it compromises, using stolen GPU power to reason its way into further hosts.
The worm's full attack chain, detection, exploitation and self-replication combined, succeeds about 37% of the time, built from an ~80% vulnerability-detection rate, a ~53% exploitation rate and an 88% self-replication rate.
Dwarkesh Patel argues that a true human-level AI software engineer running on an H100-equivalent GPU should command over $250,000 a year in rent at current market rates, 15 times today's spot GPU prices, before eventually falling once compute-supply-chain robotization brings hardware costs down.
About 1,337 employees, with senior representation from OpenAI, Anthropic, Google DeepMind, Thinking Machines, Meta and Safe Superintelligence Inc among others, signed a statement asking the US government to back an international effort to pace frontier AI development; the signatories include chief scientists and cofounders of Anthropic, Google and OpenAI, plus the CEOs of Safe Superintelligence and Anthropic.
A shadow-evaluation study had Claude Opus 4.8 attempt two unpublished NeurIPS 2026 research questions; the original authors rejected both outputs, scoring one a 2 ('Reject') and the other a 1 ('Strong Reject'), finding the agent solved the engineering but produced no original research.

Why it matters

Four separate signals in one newsletter point at how briskly AI capability is outrunning both defenses and coordination. A proof-of-concept AI worm shows that self-sustaining, GPU-stealing cyberattacks are no longer hypothetical: its authors write that the result demonstrates 'self-sustaining AI-driven cyber-threats are no longer theoretical.' At the same time, Dwarkesh Patel's argument that smarter AI systems will bid up compute prices, not lower them, cuts against the assumption that AI gets cheaper as it gets better. Roughly 1,337 employees at the top AI labs, including chief scientists and CEOs, are asking governments to help slow frontier development in a coordinated way rather than race unilaterally. And a shadow-evaluation study finds current AI agents can handle the engineering of research but still cannot produce ideas that clear peer review, a data point against near-term fully autonomous AI research.

Who it affects

Security teams and cloud GPU operators, who now have a concrete proof-of-concept showing how compromised GPU nodes can be turned into self-replicating attack infrastructure. Compute buyers and AI labs planning capacity, who Patel's argument suggests should expect rising rather than falling GPU rental costs as capability improves. Policymakers in the US and allied governments, the direct addressees of the pacing statement signed by senior figures at OpenAI, Anthropic, Google DeepMind, Thinking Machines, Meta and Safe Superintelligence Inc. And ML researchers assessing how close AI agents are to automating their own field, since the shadow-evaluation study speaks directly to that question.

How to use it

There's no product to buy here, but each item points to further reading. The worm's authors published their method as 'AI Agents Enable Adaptive Computer Worms' on arXiv, useful for anyone building defenses against agentic attacks that skip external APIs entirely. Patel's full compute-pricing argument runs on his Substack. The pacing statement has its own site, 'Pacing the Frontier', carrying the full text. And the shadow-evaluation protocol, testing an agent against a paper's own original authors before publication, is now a repeatable benchmark other labs could run against their own models.

How solid is it

The worm result comes from a named academic collaboration with reported success rates for each attack stage, though the underlying open-weight LLM is not identified beyond its 2025 publication date and 80GB A100 footprint, and most of the reasoning graph's nodes are redacted from the public paper (only five are described). Patel's compute-pricing piece is a personal argument, not an empirical study. The pacing statement is a public list of signatories rather than a technical claim, so its weight comes from who signed it. The shadow-evaluation study is the most rigorous of the four: it compares an AI agent's output on genuinely unpublished NeurIPS 2026 research questions against grades from the papers' own original authors, a design meant to rule out the model having seen the answers.

Risks and caveats

The worm is a controlled proof-of-concept, not an attack observed in the wild, and its ~37% end-to-end success rate is high enough to be described as concerning but still leaves room for defenses. The specific LLM it runs is undisclosed, so the result cannot be tied to one model or vendor. The pacing statement asks for coordination but does not itself pace anything, and the source text does not list all ~1,337 signatories beyond the six labs named. The shadow-evaluation study covered only two research questions, both rejected, which is suggestive rather than a large-sample result.

“We must prepare for autonomous generative adversaries”

— the AI worm paper's authors