autonomous attack

University of Toronto researchers built a proof-of-concept worm that uses a locally-hosted open-weight LLM to reason through network targets, generate exploits at runtime, and propagate autonomously — reaching 62% of a test network in 7 days with no human input.

Sysdig documented an LLM agent autonomously driving lateral movement from a marimo RCE to a PostgreSQL dump across four pivots in under two minutes. What this means for detection.