AI Built a Worm. What Happens When It Targets Windows?

What happens when a worm no longer carries one fixed exploit, but can decide how to attack each device it reaches?

That question is moving out of the hypothetical. In September 2026, security researchers at Calif demonstrated WeWorm, a zero-click worm that could spread through WeChat calls across iOS and Android. The same month, other research and threat intelligence showed pieces of a similar model already touching Windows environments.

Key Takeaway: AI is beginning to change worms from fixed pieces of malware into adaptive attack systems that can reason about targets, generate attack logic, and change tactics. For Windows defenders, the lesson is not that every future worm will be unstoppable. It is that security cannot depend only on recognizing the attack before restricting what it is allowed to do.

So what exactly happened?

Calif researchers used AI during vulnerability research and exploit development to build WeWorm, which demonstrated autonomous propagation through WeChat calls without requiring the recipient to answer. The research was also covered by The New York Times.

The important business lesson is not limited to mobile devices. In June 2026, researchers from the University of Toronto and Vector Institute published AI Agents Enable Adaptive Computer Worms. Their proof of concept propagated across a network containing Linux, Windows, and IoT devices.

Unlike traditional worms that depend on a predetermined vulnerability, the AI-driven worm generated attack strategies based on each target it encountered. The researchers describe malware that can reason about a target, adapt to what it observes, and synthesize attack logic in real time.

Why is the Windows research different from WannaCry?

A traditional worm such as WannaCry largely spreads by repeatedly exploiting the same weakness. An adaptive AI worm can potentially choose a different route for different systems.

That distinction matters. One Windows endpoint might expose a vulnerable service. Another might offer credentials, a trusted application, a scripting environment, an administrative tool, or an authenticated connection that can be abused.

The attack does not need to look identical from machine to machine. The research demonstrated that an AI agent can select attack strategies dynamically rather than rely on a single fixed exploit.

Are attackers already combining AI with self-propagating attacks?

Yes, although the evidence needs to be described carefully. We have not established that a fully autonomous AI-generated Windows-to-Windows worm is currently spreading through corporate networks in the wild.

But the individual capabilities are appearing in real incidents.

In its September 2026 AI Risk and Resilience report, Mandiant described an intrusion in which an attacker hijacked an active AI coding-assistant session on a developer workstation. After a poisoned dependency was installed, the attacker stole GitHub OAuth tokens and deployed the self-propagating Shai-Hulud worm across approximately 100 internal code repositories. The worm automated secret theft and source-code exfiltration.

That was not a Windows network worm, but it shows how AI-enabled development environments, trusted sessions, credentials, and self-propagating malware can intersect in a real attack.

What happens when AI can also change the malware?

Detection becomes a moving target. Anthropic's September 2026 threat intelligence report describes an actor using AI-driven workflows with multiple Windows malware families.

According to Anthropic, when monitoring agents detected that a security product had identified deployed malware, AI agents would autonomously modify and rebuild the malware to evade the existing detection. The same operation used AI to assist with command execution, credential harvesting, persistence, and lateral movement.

Anthropic also documented AI-assisted development of a modular Windows implant called SECOMS64. Supporting components included PowerShell functionality, persistence mechanisms, credential theft, reconnaissance of Microsoft Defender and Intune, and USB-drive propagation.

This creates an uncomfortable defensive loop: detect the malware, update the defense, watch the attacker change it, and repeat.

Could EDR detect an adaptive AI worm?

Potentially, yes. EDR remains important for visibility, behavioral detection, investigation, containment, and response. But the emerging research shows why Detect and Respond should not be the only endpoint control.

If attack code, commands, delivery methods, or even the path between systems can change dynamically, defenders may have less time to identify a repeatable pattern before damage begins.

This is where a different question becomes useful:

What if you did not have to detect the attack in order to stop it?

Can an unknown worm be restricted without identifying it first?

In many cases, the defender can restrict the actions an attacker needs even when the exact malware is unknown.

Changing the attack does not necessarily change the endpoint actions the attacker ultimately needs in order to succeed. On Windows, an attacker may still need to launch processes, abuse trusted applications, access memory, manipulate files, create persistence, use credentials, move laterally, reach sensitive data, or encrypt files.

Unknown does not automatically mean unstoppable.

Isolation and Containment approaches focus on reducing endpoint execution freedom and constraining what applications and processes are allowed to access. The objective is not to predict every attack. It is to restrict the actions an attacker needs in order to succeed.

AppGuard is a proven endpoint protection solution with more than a decade of production history focused on prevention through Isolation and Containment. It does not need to know the name of every attack to restrict endpoint behaviors the attack may require. It complements rather than replaces detection and response.

What Should Businesses Do Next?

Organizations should assume that some threats will evade or outrun detection, especially as AI reduces the cost and time required to modify attack tooling.

• Maintain EDR and strong monitoring, but add prevention layers that do not depend entirely on identifying malicious code first.
• Reduce unnecessary Windows endpoint execution freedom and restrict unauthorized applications.
• Constrain trusted applications so they cannot freely access memory, files, credentials, or system resources they do not need.
• Review privileged access, remote-management tools, developer environments, AI assistants, API tokens, and third-party access paths.
• Segment critical systems and test how quickly a compromised endpoint could reach other systems or sensitive data.
• Test ransomware, worm-propagation, and endpoint-failure scenarios, including what happens when detection arrives late.
• Review backups, recovery processes, and incident-response plans for machine-speed attacks.
• Evaluate Isolation and Containment where reducing usable Windows attack surface would limit the blast radius of an unknown threat.

What is the larger lesson?

The first important development is not that AI has created one unbeatable super-worm. It has not.

The important development is that the building blocks are coming together: AI-assisted vulnerability discovery, adaptive exploit generation, autonomous propagation, credential abuse, Windows malware development, lateral movement, and automated evasion of existing detections.

That makes prevention increasingly important. The attack may be new. The actions it needs to perform on a Windows endpoint often are not.

For more on reducing Windows attack surface before a threat is identified, review the AppGuard prevention and containment overview.