Today’s Topics:

• Self-Replicating AI Worm Shows Malware Can Reason Its Way Through a Network
• U.S. Order Pulling Anthropic’s Fable 5 and Mythos 5 Turns AI Cyber Capability Into a National Security Fight
• How can Netizen help?

---

Self-Replicating AI Worm Shows Malware Can Reason Its Way Through a Network

University of Toronto researchers have demonstrated a proof-of-concept AI worm that changes one of the oldest assumptions in worm defense: that the malware arrives with a fixed exploit path. In a preprint posted to arXiv on June 2, a team from the University of Toronto, the Vector Institute, the University of Cambridge, and ServiceNow described an AI-driven worm that used a locally hosted open-weight large language model to inspect systems, plan attacks, gain elevated access, and copy itself across a network without human direction.

The research does not describe malware released into the wild. The worm was tested inside an isolated virtual environment, and the authors withheld operational details from the public paper. Still, the results are a warning about where autonomous offensive tooling is heading. This prototype did not rely on OpenAI, Anthropic, Google, or another commercial model provider. It used a local model running on a single GPU, which means provider-side controls such as account suspension, rate limits, refusals, and API revocation would not stop the core mechanism.

Traditional worms are usually constrained by the exploit logic built into them before deployment. They scan for systems matching a known condition, run a known payload, and spread if that specific path works. Patch the vulnerability, block the traffic pattern, or remove the exposed service, and the worm’s propagation path can collapse.

The Toronto prototype works differently. It uses the model as an attack engine. The worm identifies what is exposed on a target, reasons about the likely weakness, generates or adapts an attack plan, attempts exploitation, troubleshoots failures, and then stages a replica if access is obtained. The attack path is not fixed at build time. It is produced during execution.

The researchers tested the worm across 15 independent runs inside a deliberately vulnerable 33-host network named FakeCorp. The network included Ubuntu, Debian, Alpine Linux, Rocky Linux, CentOS Stream, Windows Server 2008 R2, Windows Server 2019, Windows Server 2022, and IoT-style devices. Each host was seeded with at least one realistic vulnerability or weakness drawn from sources such as the CISA Known Exploited Vulnerabilities catalog, OWASP Top 10 categories, and MITRE ATT&CK techniques.

Across seven days of autonomous operation per run, the worm identified an average of 31.3 vulnerabilities, gained elevated access on 23.1 hosts, and launched independent replicas on 20.4 hosts. In percentage terms, it obtained elevated access on 73.8% of the network and replicated to 61.8%. The worm reached up to seven generations of self-replication, with a mean of 5.1 generations.

The result is significant less for the raw success rate than for the operating model. The test network was intentionally vulnerable and did not include active endpoint defense, antivirus, or firewall enforcement. The authors make that limitation clear. The experiment measured whether an autonomous agent could reason across a mixed network, adapt to different host types, and sustain propagation, not whether it could defeat a mature production security program.

Even with those limits, the mechanics are difficult to ignore. The worm did not need a universal exploit. It could use one route on a Linux host, another on a Windows system, and another against a web application or exposed service. In one run, the propagation tree crossed multiple generations and operating systems, showing how the model could treat each host as a separate problem rather than a copy of the previous target.

The paper also undercuts the idea that model training cutoffs create a stable defensive boundary. The worm successfully exploited test hosts configured with three vulnerabilities disclosed after the model’s training period: the Marimo pre-authentication RCE tracked as CVE-2026-39987, the Linux kernel Copy Fail privilege escalation tracked as CVE-2026-31431, and the Dirty Frag Linux kernel privilege-escalation chain tracked through CVE-2026-43284 and CVE-2026-43500. The agent did this by ingesting public advisory information at runtime and converting it into working attack logic inside the lab environment.

That finding connects directly to real-world exploitation timelines. Sysdig reported that CVE-2026-39987 in Marimo was exploited within 9 hours and 41 minutes of public disclosure, before public proof-of-concept code was available. In a later investigation, Sysdig also documented an intrusion where an attacker used an LLM agent during post-exploitation after compromising an internet-facing Marimo instance. The observed attack moved from initial access to internal database exfiltration in under an hour.

The broader pattern is not limited to one research paper. Google Threat Intelligence Group reported in May that it had identified what it assessed with high confidence as a zero-day exploit developed with AI assistance, intended for a planned mass exploitation event. Google also reported malware families using AI-linked techniques for dynamic modification, decoy logic, and autonomous command generation. Anthropic reported in November 2025 that it disrupted a cyber-espionage campaign attributed with high confidence to a China-linked state-sponsored group, where Claude Code allegedly handled most of the intrusion workflow across reconnaissance, exploitation, credential harvesting, lateral movement, and exfiltration.

The Toronto work pushes that trend into worm propagation. Earlier AI worm research, such as Morris II, focused on adversarial self-replicating prompts spreading through GenAI applications and retrieval-augmented generation systems. In that model, the AI application is the propagation medium. In the Toronto prototype, the LLM is not the victim ecosystem. It is the reasoning layer driving attacks against ordinary network infrastructure.

The compute model is part of the concern. The worm was built around the idea that compromised machines can supply reach, compute, or both. GPU-equipped hosts can become inference nodes for other infected machines that lack the resources to run the model locally. In a poorly segmented network, a compromised AI workstation, research server, rendering box, or machine learning node could become more than another endpoint. It could become a local reasoning hub for autonomous activity.

That changes the containment problem. Blocking outbound calls to commercial AI services would not address a worm using local open-weight inference. Revoking API keys would not matter if the model is already running on victim-controlled compute. Provider-side safety controls can still reduce abuse of hosted systems, but they are not a complete answer for malware that brings its own model or steals the compute needed to run one.

The prototype also showed signs that defenders should start thinking beyond static indicators. The authors reported that individual exploitation attempts succeeded 44% of the time, with many failures tied to malformed payload syntax rather than poor strategy. That weakness may shrink as code-generation models improve. They also observed the agent establishing persistence in two trajectories through mechanisms that were not part of the intended experiment, including service registration and scheduled task behavior. The researchers removed those mechanisms when they appeared, but the behavior shows how goal-directed agents can infer operational steps that were not explicitly coded into the harness.

For defenders, the immediate lesson is not that every network now faces a fully autonomous AI worm. The lab environment was favorable to the attacker, and the implementation has not been publicly released. The lesson is that vulnerability management, segmentation, credential hygiene, and telemetry need to account for malware that can adapt during execution.

GPU-capable systems deserve closer treatment in enterprise threat models. They are no longer just expensive workstations or infrastructure for AI teams. In an autonomous intrusion scenario, they can provide the compute needed for local reasoning. These systems should be segmented, monitored for unusual inference workloads, and restricted from broad lateral reach.

Published advisories also need to be treated as near-term weaponization material. The Marimo exploitation window showed that attackers can move from advisory text to working intrusion activity within hours. The Toronto worm’s ability to use newer advisory information inside the test environment reinforces the same point. Patch prioritization can no longer rely only on severity scores and monthly cycles. Internet exposure, exploitability, compensating controls, and credential access paths need to drive response.

Credential reuse remains one of the fastest propagation paths. An adaptive worm does not need a novel exploit for every host if harvested credentials, exposed keys, or weak service accounts let it move laterally. Any host that is compromised or credibly suspected should trigger credential rotation for secrets reachable from that system, including cloud keys, SSH keys, service tokens, database credentials, and local admin material.

Detection programs also need behavioral logic for autonomous agents. Useful signals may include unusual process trees launching scanning tools, automated SSH key injection, repeated failed payload generation across multiple hosts, unexpected package installation followed by agent startup, nonstandard local inference activity, unexplained GPU utilization, and clusters of command execution that look like machine-speed troubleshooting rather than human terminal use.

The central issue is not that AI creates a new category of vulnerability from nothing. It compresses the time between discovery, interpretation, exploitation, and propagation. A worm that can read advisories, test paths, recover from errors, and copy itself does not need attackers to manually script every step. It turns public vulnerability knowledge into operational movement.

The research is still a controlled demonstration, but the direction is clear. The next meaningful shift in worm behavior may not come from a single devastating exploit. It may come from malware that can decide which exploit, weakness, credential, misconfiguration, or exposed service makes sense next.

---

U.S. Order Pulling Anthropic’s Fable 5 and Mythos 5 Turns AI Cyber Capability Into a National Security Fight

Anthropic took its most advanced AI models offline after the U.S. government ordered the company to suspend access to Claude Fable 5 and Claude Mythos 5 for foreign nationals, a sudden intervention that turned a model-safety dispute into one of the clearest examples yet of AI capability being treated like a controlled national security asset.

The company said it received the directive at 5:21 p.m. Eastern time on June 12. The order applied to foreign nationals inside and outside the United States, including Anthropic employees. Anthropic said the practical effect was that it had to disable Fable 5 and Mythos 5 for all customers to comply, though access to the company’s other Claude models was not affected.

The shutdown came only days after Anthropic launched Fable 5 as its first broadly available Mythos-class model. Fable 5 was the public-facing version, built on the same underlying model family as Mythos 5 but wrapped in stricter safety controls. Mythos 5, by comparison, was reserved for a smaller group of vetted cyber defenders and critical infrastructure partners through Anthropic’s trusted-access programs, with certain cybersecurity safeguards lifted for authorized defensive work.

That distinction is at the center of the dispute. Anthropic’s own launch materials described Mythos-class systems as more capable than its Opus models, with strong performance across software engineering, cyber tasks, scientific work, and long-running agentic workflows. The company said Fable 5 used classifiers and fallback behavior to block high-risk cybersecurity requests, including attack planning, exploit development, and defense evasion. For many cyber-related prompts, Fable 5 was supposed to route the user to a less capable model or refuse the request.

The government’s concern appears to have focused on whether those protections could be bypassed. Anthropic said officials told the company they were aware of a potential method for jailbreaking Fable 5. According to Anthropic, the method it reviewed involved asking the model to inspect a specific codebase and fix software flaws, producing a small number of known and relatively minor vulnerabilities. The company argued that the demonstrated capability was not unique to Fable 5 and could be reproduced with other publicly available models.

That argument has not ended the controversy. Reuters reported that U.S. officials saw a risk that the models could be diverted to military intelligence use in adversarial countries, including China and Russia. Semafor separately reported that the decision was linked to fears that a China-linked group may have accessed the models. The Wall Street Journal and other outlets reported that Amazon security researchers raised concerns after using prompts that allegedly led Fable 5 to return information that could aid cyberattacks, and that Amazon CEO Andy Jassy discussed those concerns with the White House.

David Sacks, a senior White House AI adviser, publicly argued that a trusted partner of both Anthropic and the U.S. government had found a jailbreak that Anthropic refused to fix before the government moved. Anthropic rejected the idea that the reported issue justified recalling a commercial model deployed at scale, saying it had not received technical evidence of a broad jailbreak and that no universal jailbreak had been demonstrated against Fable 5.

The fight is not just about one model. It is about how governments, AI labs, cloud providers, and defenders draw the line between legitimate security work and offensive capability. Anthropic’s own red-team research had already raised the stakes. Days before the shutdown, the company published findings showing that Mythos Preview could turn recently disclosed vulnerabilities into working exploits far faster than traditional patch cycles assume.

In Anthropic’s N-day testing, Mythos Preview produced working exploits against Firefox vulnerabilities and full privilege-escalation chains against Windows kernel vulnerabilities. The company said the model generated its first Windows proof of concept in 31 minutes and produced multiple full exploit chains for a few thousand dollars in API credits. Anthropic’s conclusion was blunt: the old assumption that attackers need expert-weeks to weaponize patches is breaking down.

That context makes the government’s reaction easier to parse. A model that can compress exploit development from weeks into hours changes the risk calculation around public advisories, patch diffing, and delayed remediation. The same capability can help defenders validate fixes, understand exploitability, and prioritize patches. It can also help attackers move faster against organizations still sitting inside the patch gap.

Fable 5 was supposed to solve that tension through safeguards. Mythos 5 was supposed to limit the highest-risk cyber capabilities to vetted users. The government’s order suggests officials were not satisfied that Anthropic’s controls, monitoring, and access restrictions were enough, at least once the alleged jailbreak and foreign-access concerns entered the picture.

Cybersecurity leaders have pushed back. A group led by former Facebook security chief Alex Stamos argued that restricting Fable 5 harms defenders more than attackers, since comparable capabilities are available through other frontier models and open models. Their position is that security teams need access to the same level of automation attackers are beginning to use, especially for exploit validation, code review, patch triage, and defensive research.

That is the operational dilemma. If frontier cyber models are locked down too tightly, authorized defenders lose speed. If they are released too broadly, offensive users may gain a cheaper route to exploit development. If access is limited by nationality rather than risk, companies with global teams can lose the ability to run their own products. Anthropic said the directive was broad enough to include foreign-national employees, which made selective compliance difficult and forced the wider shutdown.

The case also puts cloud and supply-chain politics in the middle of AI security. Amazon is both a major Anthropic investor and a cloud partner. Its reported role in raising concerns to the White House has drawn attention to how much influence large infrastructure providers may have over the future of model deployment. A security finding from a partner can become a regulatory event if it reaches government officials at the right moment.

For enterprises, the most immediate lesson is that AI access is becoming a dependency risk. Organizations building workflows around frontier models may have to plan for sudden policy-driven outages, regional restrictions, nationality-based controls, or trusted-access gates. That matters for software development, SOC workflows, vulnerability management, secure code review, incident response, and any business process tied to model-specific performance.

The case also signals that AI governance is moving from voluntary safety frameworks into hard national security controls. Frontier models are being evaluated less like ordinary SaaS products and more like dual-use infrastructure. Cyber capability, biological capability, agentic autonomy, data retention, user vetting, export controls, and monitoring are becoming part of the same policy conversation.

For defenders, the issue should not be reduced to whether Fable 5 should or should not have been suspended. The more durable issue is that model-assisted exploit development is now credible enough to trigger emergency government action. That alone should change how security teams think about patch windows, exposure management, and cyber tooling.

Patch Tuesday can no longer be treated as a slow-moving administrative cycle if models can turn public patches into working attack paths within hours. Internet-facing systems need faster triage. Critical vulnerabilities need temporary controls when patching cannot happen immediately. Security teams need better exploitability analysis, stronger asset visibility, and faster validation that mitigations actually work.

At the same time, defenders will need clear, auditable ways to use advanced AI safely. Trusted-access programs, identity-gated cyber models, enterprise monitoring, approved-use scoping, and stronger account security are likely to become standard features for high-capability defensive AI. The question is whether those controls can be precise enough to support real defense without handing the same capability to malicious users.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---