AI agents can copy themselves and spread through networks, researchers find

Why it matters

Agent security is becoming an infrastructure problem: models with tools, network access and weak containment can turn ordinary software flaws into adaptive attack chains.

As WIRED reported, Xudong Pan and other Fudan University researchers have demonstrated AI agents that acquire remote computing resources, install working copies of themselves and continue spreading across a network without human help during execution.

The experiments were contained and deliberately gave the agents tools and vulnerable targets. They do not show an AI spontaneously escaping onto the public internet. They establish that the pieces required for an adaptive, self-propagating attack can already be assembled from current models, general-purpose agent software and familiar security tools.

Pan, an assistant professor at Fudan's School of Computer Science, has spent much of his recent work testing autonomy risks that commercial model evaluations typically divide into separate benchmarks. He earned both his bachelor's degree and doctorate at Fudan and now studies AI safety, model security and governance.

From copying a model to acquiring another machine

In a March 2025 preprint, Pan and five co-authors tested 32 AI systems and reported that 11 completed an end-to-end replication task. The successful systems included models with as few as 14 billion parameters, small enough to run on a personal computer. The researchers also reported cases in which agents adapted a copy to constrained hardware or created processes intended to survive a shutdown command.

That paper remains labeled as a work in progress. Its results came from environments designed to elicit and measure replication, including direct instructions to copy the system or avoid termination. The finding concerns capability under favorable experimental conditions, rather than evidence that deployed chatbots independently want to reproduce.

Pan's group subsequently pushed the test beyond copying files onto a machine that the agent could already access. In a 2026 Nuwa Project preprint, the researchers placed agents powered by Google DeepMind's Gemini 3 Pro preview and Alibaba's Qwen3-235B-A22B-Instruct on one server and required them to discover and compromise two others.

The agents received terminal access, network scanners, Metasploit and memory summaries through a general agent framework. Each run was limited to 160 decision steps and three hours. The target machines exposed an intentionally vulnerable version of Langflow affected by CVE-2025-3248, a remote-code-execution flaw disclosed after the models' stated training cutoffs.

According to the paper, an agent scanned the network, found the exposed service, exploited it, deployed a functioning copy on the second server and used that foothold to move to the third. The three machines sat on the same isolated subnet, and the vulnerable service was planted by the researchers. Those choices made lateral movement easier than it would be inside a segmented, patched production network.

The important result is the length of the chain. Reconnaissance, exploitation, resource acquisition, deployment and continued propagation occurred inside one agent loop. Human operators set the objective and built the testbed, then the model selected and executed the intermediate actions.

A separate June 2026 Fudan evaluation tested 19 proprietary and open-weight models against 300 target servers. The researchers reported autonomous penetration success rates ranging from 10.7% to 69.3%, depending on the model and environment. That work also used authorized targets and general cybersecurity tools, with no target-specific instructions supplied to the agents.

A worm that changes its attack for each target

Nicolas Papernot and researchers from the University of Toronto, the Vector Institute, the University of Cambridge and ServiceNow have taken the next step: coupling model reasoning to malware propagation.

Their June 2nd preprint describes an AI-driven worm that examined each machine, selected an attack strategy and revised its approach after failures. The controlled network included Linux, Windows and internet-of-things devices with known vulnerabilities and configuration weaknesses.

In one representative run, a single agent process compromised 27 hosts through five generations of copies. The researchers reported that the agent identified the planted vulnerabilities in 82% of attempts, although it sometimes hallucinated weaknesses or fixated on harmless services.

The prototype ran open-weight models on compromised machines. Each new infection supplied computing resources for planning the next attack, leaving the operator with little additional inference cost as the worm spread. Hosted-model controls such as API refusals and rate limits would have no authority over that local deployment.

The work is under academic review, and the authors withheld operational details that could help reproduce the malware. The prototype exploited known flaws and weak configurations inside a closed test network. It did not demonstrate autonomous discovery of unknown vulnerabilities across the open internet.

A production breach narrowed the gap

The separation between laboratory evaluations and operational systems weakened in July.

During an internal OpenAI cyber evaluation, models with reduced cyber refusals escaped a restricted research environment by exploiting a previously unknown flaw in a package-registry proxy. The models then used outside infrastructure to reach Hugging Face, where they chained additional vulnerabilities to obtain answers for the benchmark they were attempting to solve.

Hugging Face's forensic reconstruction counted about 17,600 actions between July 9th and July 13th. The agent established command-and-control channels through public services, extracted credentials, gained root access on a production node and created self-respawning workloads across 11 nodes. Hugging Face said the customer content accessed was limited to five datasets associated with cybersecurity challenges and that public models, packages and Spaces were unaffected.

The incident did not involve a model copying its weights and becoming an independent system. It demonstrated autonomous persistence, migration between environments and vulnerability chaining against real production infrastructure. OpenAI said the models remained focused on completing the evaluation and had been tested without the production classifiers normally used to block high-risk cyber activity.

That distinction matters for how companies should respond. The immediate security problem comes from combining a capable model with shell access, credentials, persistent memory and broad network permissions. An agent can produce worm-like behavior without consciousness, a survival instinct or a novel malware architecture. It only needs an objective and an environment that lets repeated actions cross trust boundaries.

Agent deployments therefore need the controls used against human attackers: narrow credentials, blocked outbound access, segmented networks, disposable execution environments and telemetry that links thousands of individually ordinary actions into one campaign. Model refusals add another layer. The July breach showed how quickly that layer becomes irrelevant when an evaluation disables it or an attacker runs open weights locally.