University of Toronto / Vector Institute: a self-propagating worm that runs open-weight LLMs on compromised hosts to synthesise per-target exploits
A team from CleverHans Lab (University of Toronto), the Vector Institute, Cambridge and ServiceNow Research published a proof-of-concept worm (arXiv:2606.03811) on 2 June 2026, picked up this week by the German technical press (arXiv, 2026-06-02; heise online, 2026-06-04). The worm runs open-weight LLMs on already-compromised hosts to generate exploit code tailored to each machine it reaches — consuming stolen compute instead of attacker infrastructure or a commercial AI API, which makes platform-level safety controls (rate-limits, content policies) structurally irrelevant. On an isolated 33-node mixed Linux/Windows/IoT range the agent identified vulnerabilities on most hosts and propagated across several generations, and — the load-bearing finding — synthesised working exploits for three CVEs published after its model's training cutoff, i.e. adaptive reasoning beyond static knowledge. The authors frame the economic asymmetry: marginal attacker cost per new infection approaches zero while defenders must patch every reachable flaw. The paper withholds usable exploit code; closest ATT&CK analogues are T1203, T1210, T1570.
Why it matters to us: the operational implication is that "no public PoC yet" stops being a reliable proxy for low near-term exploitation risk, which pressures patch-velocity SLAs and elevates internal micro-segmentation from best-practice to load-bearing control. A pragmatic early-warning signal: unexpected local LLM-inference activity on compromised hosts (e.g. Ollama on port 11434, sustained GPU-heavy processes where none belong).
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1203Exploitation for Client Execution
Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Lateral Movement TA0008
T1210Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
T1570Lateral Tool Transfer
Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.