A worm no longer has to carry a fixed exploit list to spread. A small local model on a compromised machine can inspect the next target, reason through the weakness, and generate a fresh attack plan on the fly, which makes mixed Windows, Linux, and IoT fleets harder to predict and easier to traverse.
Researchers from the University of Toronto, the Vector Institute, and the University of Cambridge tested a proof-of-concept worm in an isolated 33-host network and showed it could adapt to disclosed-but-unpatched flaws, misconfigurations, and recurring weakness classes. It also used public advisories at runtime to work against vulnerabilities disclosed after the model’s training cutoff, so patch timing matters even when the attacker is not starting from a novel zero-day.