AI Worms Are Changing the Cybersecurity Equation

Why Zero Trust, containment and controlling access matter as cyber threats become more autonomous

Recent reporting on the emergence of AI-enabled computer worms raises an important question: What happens when malicious software can do more than spread from one computer to another—when it can reason, adapt, and potentially determine how to compromise unfamiliar systems on its own?

The concern is not simply a new generation of malware. It is the potential emergence of autonomous cyber threats that adapt their behavior faster than conventional security operations can investigate and respond. For critical infrastructure that makes preventing unauthorized execution and limiting access more important.

From traditional worms to agentic AI

Computer worms are not new. Unlike viruses that generally depend on a host file or program, worms can independently replicate and spread between vulnerable systems. Traditional worms use programmed logic and predefined techniques. WannaCry, for example, spread by exploiting a known Windows vulnerability.

Agentic AI could change how a worm chooses its next action. Instead of relying exclusively on predetermined instructions, it might analyze its surroundings, identify weaknesses, select different techniques and adjust after failed attempts. Some proposed designs could also use computing resources on compromised systems for local inference. These are emerging capabilities, not proof of an uncontrolled agentic worm circulating through industrial networks.

The distinction matters: traditional worms automate propagation; agentic AI could increasingly automate the decisions that sustain and expand an attack.

Why critical infrastructure faces a different risk

Food production, water treatment, utilities and manufacturing depend on connected IT and OT systems: engineering workstations, human-machine interfaces, manufacturing execution systems, industrial controllers and remote-access platforms. Many remain in service for decades. They cannot always be interrupted for patching or rebooting without affecting availability, safety or production.

An adaptive worm entering a poorly segmented environment could search for other vulnerable systems. But compromising a network-connected device is not equivalent to controlling a physical process. Changing refrigeration temperatures or water treatment settings requires additional privileges and access to operational controls. Those are the boundaries that must be protected.

The real question is authority

As autonomous software becomes more capable, defenders must ask not only whether a device or agent is compromised, but what is permitted to execute, access, modify or control. Authentication to a network must not confer unrestricted trust. An authorized AI agent should not receive unrestricted tools or credentials. A compromised engineering workstation should not provide an open path to controllers.

From detection to preventative security

Detection remains necessary, but it cannot be the only line of defense against rapidly adapting attacks. A layered architecture should reduce attack surface through hardened, immutable endpoint operating systems; verify device and workload identity and posture; enforce least privilege and network segmentation; constrain automated execution and tool permissions; and provide containment and tested recovery procedures.

For high-consequence actions, independent authorization, human intervention and physical safety controls are especially important. Immutability can impede certain persistence techniques, but it is not a substitute for patching, segmentation, monitoring or safe industrial design.

Extending Zero Trust across IT, OT and AI

These environments increasingly share endpoints, networks, identities and applications. Security and governance therefore need to span traditional enterprise IT, operational systems and emerging AI workloads.

At IGEL, this convergence informs the IGEL Adaptive Secure Endpoint Platform^TM (IASEP). Its immutable endpoint operating system and Universal Management Suite^TM (UMS) provide a governed foundation for enrolled endpoints, with centralized configuration and contextual policy capabilities. Integrated with network access control and security ecosystem partners, this approach can help implement Zero Trust access decisions, comply-to-connect policies and segmentation around operational assets, including legacy systems that cannot readily be replaced or patched. The goal is to control the pathways into and out of those systems, rather than depend on an assumed air gap.

Emerging approaches involving trusted execution, cryptographic attestation and AI runtime governance offer further opportunities to connect verifiable endpoint evidence with upstream security policy. These should be understood as architectural directions and integration opportunities, not as claims that every proposed capability is currently available.

What operators should do now

Organizations need not wait for a widespread agentic worm. They should inventory critical endpoints and process dependencies; reduce unnecessary exposure; and apply Zero Trust segmentation to protect legacy operational systems without assuming that physical or logical air gaps will remain intact. That means verifying the identity and posture of connecting endpoints, enforcing least-privilege access, restricting east-west movement and remote or automated command authority, and continuously applying contextual policies. Where IGEL endpoints are deployed, IASEP and UMS can serve as the governed endpoint foundation, working with network access control and security partners to support segmentation and comply-to-connect enforcement. Organizations should also rehearse containment and recovery while preserving independent operational safety protections.

The next challenge is controlling authority

AI-enabled worms do not yet justify claims that every connected appliance or industrial system can be autonomously commandeered. Significant technical barriers remain. But the direction of travel is clear: as software becomes more adaptive, cybersecurity must govern what software, including autonomous software, is allowed to do.

The goal is not merely to keep a worm out. It is to ensure that compromising one endpoint cannot become a pathway to disrupting an entire operation. Prevention, containment and resilience must be designed into the architecture.

Further reading

Anthropic research on self-replicating AI (October 2026) — https://www.anthropic.com/research/self-replicating-ai

AI Agents Enable Adaptive Computer Worms (research paper) — https://arxiv.org/abs/2606.03811