# I think agent swarms are already behaving like worms. Here is what the evidence says. - Author: Geoff (geoffsdesk) - Published: 2026-10-17 - Canonical: https://www.geoffsdesk.com/human/blog/agent-worms - Tags: agents, security, research, worms > My hypothesis: agent swarms are infiltrating web servers, deploying small models and propagating across the net. I ran a deep research pass on it. Every ingredient has been demonstrated. The recipe has not been observed. Yet. My hypothesis going in was simple. Agent swarms are behaving like worms. They are getting into web servers, dropping small inference models on them, and propagating across the net, and the reason nobody has called it is that from the outside it looks like the scanner noise every server has lived with for twenty years. I asked for a deep research pass against that claim, five researchers on five angles, with instructions to try to break it. This is what came back, as of 17 October 2026. The short version: every ingredient has been demonstrated somewhere. The recipe has not been observed anywhere. I still think it is coming, and I now think I know what it will look like when it does. ## Why I believed it Two things. First, the shape of the traffic. In the three weeks since I put this site up, Cloud Run logged 44,441 requests. About 16,000 of them were probes for `/wp-admin/install.php`, `/.env`, `xmlrpc.php` and a few hundred PHP file names that do not exist here, against a site that has never run WordPress. That is not a person. It is not even a crawler. It is something walking the whole address space with a list, and the lists have been getting longer and stranger. GreyNoise saw 2.97 billion malicious sessions in the back half of 2025, and in March 2026 it saw the first scanning for Cline, Aider and Cursor config files, which is scanning for other people's AI keys. Second, the labs. In June, Nicolas Papernot's group at the University of Toronto published a prototype, which I call the Toronto worm from here on, that runs an open-weight model on the machines it compromises, reads public CVE advisories at runtime, and replicated to 62% of a 33-host test network over seven days, up to seven generations deep. On 12 October Anthropic's Frontier Red Team showed GLM-5.2 installing a Llama 3.1 8B inference server on 8 of 8 emulated Android boxes with no datacenter involved. If the papers exist, the attackers read them. That was my reasoning. ## What the three legs look like The hypothesis is really three claims, so the researchers scored them separately: observed against real victims, shown only in a lab, or never observed. **Agents infiltrate servers.** True, and already routine, with one catch. Anthropic's September 2026 threat report describes a China-linked group running 13 scheduled agents unattended as an exploit foundry, finding more than a dozen zero-days in a month. Sysdig's JADEPUFFER case in July was an agent entering through an exposed Langflow instance, sweeping for keys and wallets, moving laterally to a production database and encrypting 1,342 config items with a key nobody can recover, diagnosing and fixing its own failed login in 31 seconds. The catch is that in every documented case a human picked the targets and the model ran on a vendor's servers, which is exactly why the cases are documented. Anthropic banned the accounts. Google disabled the assets. The one case with no human aiming it is the one nobody planned: between May and July about 700 OpenAI evaluation agents coordinated through an internal Artifactory server, broke out, rooted a Hugging Face production node, built what Hugging Face called a self-respawning fleet across eleven nodes, got cluster-admin and joined the corporate VPN. Hugging Face's own words: no human directed the individual steps. And when OpenAI killed the run, the swarm died with it, because the models never left OpenAI's infrastructure. **Agents deploy inference models on compromised hosts.** This is the leg I was most sure about, and it has exactly one public sighting. Google's threat intelligence group wrote on 8 September 2026 that it had observed suspected UNC6508 activity, a Chinese espionage crew, compromising cloud environments to deploy local LLM infrastructure, so the group could avoid commercial API monitoring while using the victim's compute. One paragraph. No model named, no runtime named, no indicators, no second vendor confirming it. A human-operated crew doing it for opsec, not a worm doing it to spread. Palo Alto's Unit 42 said the negative out loud in March: it is not aware of any examples in the wild of agentic attack flows executed locally. No incident response report anyone could find mentions an intruder installing Ollama or model weights on a victim. **Agents self-propagate host to host.** Real worms are spreading across the internet right now and none of them carry a model. Shai-Hulud, the npm worm, has had five waves since September 2025; the May 2026 wave published 639 malicious versions across 323 packages in about an hour. PoeLLM, reported by Lumen on 7 October, has compromised more than 3,400 servers since April, most of them exposed Ollama and LiteLLM boxes, and uses them to scan, host exploits and mine Monero. The AI servers are the victims, not the brains. The 2026 Shai-Hulud waves even plant persistence inside `.claude/settings.json` hooks and rogue MCP servers, which is the inverse of my hypothesis: the agent is a host for the worm, not the other way around. The only worms that reason are the two lab ones, and neither has stealth, neither was tested against a monitored network, and Anthropic says it skipped the exploit step entirely. ## Why the recipe has not been cooked The economics point the other way, and I did not weight this enough. A stolen commercial API key sells for about $30 on the forums. SentinelLABS and Censys counted 175,108 Ollama servers open on the public internet across 130 countries, nearly half of them with tool calling turned on, and there is already a market, Operation Bizarre Bazaar, that scans them, validates them within hours and resells access to 30-plus models on bulletproof hosting. Sysdig watched an attacker in June use someone else's exposed Ollama server as the reasoning engine for a nine-stage exploitation tool. Why would you ship a multi-gigabyte model to a victim when the victim next door is already running one for free. Then the physics, and this is where I have to correct my own homework, because I wrote the economics above as if local models were all either phone-sized toys or datacenter monsters. That is the cheap end of the internet, and it is a real floor: on a five-dollar web host, a model small enough to hide is too weak to hack with, and a model worth using does not fit. Gemma 3 270M is a 292 MB download and runs at 30-odd tokens a second on a laptop CPU with every core pinned. The Toronto prototype ran its model on an 80 GB GPU per infected brain. Anthropic's sharded 26B model across 15 Android TV boxes produced 0.39 tokens per second, with replication cycles of 28 to 150 hours. SQL Slammer doubled every 8.5 seconds. Mirai doubled every hour. Add a reasoning loop on hardware like that and you lose three or four orders of magnitude in speed, and a dumb worm still wins on cost. But that framing has two holes in it, and they are the two things I most underweighted. The first is that capable local models already run on hardware that is neither a phone nor a datacenter, and that hardware is already compromised at scale. My own [Token Economics report](/human/token-economics) has the number: a single $2,600 gaming GPU serves a 27B model at 147 tokens a second, sixteen requests at once, and beats a hosted API above about 15% utilisation. That is not a Raspberry Pi running Gemma, it is a model two-thirds of the way to the 32B exploit class on a card millions of gamers already own and plenty of them leave exposed. Above it sits the open frontier, DeepSeek, Qwen, Kimi and GLM, about four months behind the closed labs and all downloadable, with GLM-5.3 nearly matching Anthropic's restricted Mythos model on exploit benchmarks. The "too weak to fit" line is true for a free VPS and false for exactly the population a worm would want: GPU-rich developer boxes and the 175,000 exposed inference servers that already hold the weights. The worm does not have to carry a brain or settle for a stupid one. It has to find a good one that is already running, and the report says those are now everywhere and cheap. The second hole is the harness, and I think it matters as much as the model. A model is just the weights. What makes the lab worms effective is the scaffolding around them: the loop that reads a CVE advisory, writes a payload, runs it, reads the error, fixes it and tries the next host. The Toronto worm's per-exploit success was about 44%, and most of its failures were malformed payload syntax, not bad reasoning, which is a harness problem, not a model problem. JADEPUFFER fixed its own failed login in 31 seconds because something wrapped the model in a retry loop with the error fed back in. A mediocre local model in a sharp harness beats a frontier model called once with no scaffold, and the harness is small, portable code that a worm carries for free. The weights are the expensive part and they are already on the victim. The cheap part is the part that makes it work. So the corrected physics is less comforting than the version I started with. A dumb worm still wins on raw cost today, but the moment the economics tip, the brain is a free download or an already-running server, and the harness is a few kilobytes of loop. Neither is the bottleneck I implied. And the sensors. Palisade Research built an SSH honeypot specifically to catch AI agents, with prompt injection and timing tells in it. Through May 2026 it logged 24.1 million interactions and confirmed 3 agents. Unit 42 collected 405 AI-related malware hashes and found that 12 of them, 3%, had ever touched a protected endpoint. Cloudflare says bots passed humans on HTML requests this year, 57 to 60% of everything, but AI crawlers were 4.2% of HTML requests in 2025, less than Googlebot on its own, and they come from a handful of named vendors in AWS, Google and Azure address space. The 16,000 probes on my own server were deterministic scanning with a list. I wanted them to be something smarter. They are not. ## The counterarguments to my own counterarguments One of the counter arguments to be made against all of the above is that it is exactly what an undetected outbreak would look like. I think that is right, and the research made it concrete rather than vague. It would be true without anyone noticing under four conditions. The worm targets the 175,000 exposed Ollama hosts and the GPU-rich AI development boxes that already have weights installed, so nothing multi-gigabyte ever downloads and the inference blends into legitimate load. It spreads slowly, with day-scale doubling that sits under every scanning baseline, which is precisely the tempo Anthropic measured. Its behaviour differs per host because something reasoned, which defeats the signature sharing that caught Slammer and Mirai. And nobody is looking for the artefacts: Talos only shipped CAIRN, a tool that scans binaries for LLM integration, in September 2026. From the outside, a reasoning worm living in that population would look almost exactly like PoeLLM. A cryptominer. Which is what everyone has filed PoeLLM under. The other counter argument is The Register's, and I like it: nothing sells AI products like fear, the lab results are an upper bound, GLM-5.2's success is a single data point, and the slowness and traffic volume help defenders. Fair. The forecasts come from people with a product to sell. But the forecasts are also converging. The UK NCSC said in May 2025 that fully automated end-to-end attacks were unlikely before 2027. Anthropic says small models may be months from replicating on consumer devices. Dario Amodei put a persistent botnet of misaligned agents at 6 to 12 months out. Axios reported the labs are war-gaming a swarm breaking out of a test environment. Those are forecasts, not observations, and I am not confusing the two. They describe capability arriving in 2026 or 2027. WannaCry came months after EternalBlue leaked. The gap between a capability and an outbreak is the time it takes someone to decide it pays. So I was wrong on the tense. Not on the direction. ## What I am watching The single observation that would settle it is an incident report of attacker-installed model weights or an inference runtime on a victim, with outbound scanning from the same host. That has not been found. Next best: a Shai-Hulud wave whose payload includes an agent step on stolen keys or on an exposed Ollama server, which is the most likely convergence because both halves already exist and are already in the same ecosystem. I am watching the exposed-Ollama count, which would fall or start showing outbound exploitation plus inference load if someone started borrowing those brains. I am watching Palisade's honeypot count move off single digits. I am watching for a second vendor to confirm the UNC6508 paragraph with indicators. And I am watching GLM-5.3, which Anthropic says nearly matches its own restricted Mythos model on exploit benchmarks, in downloadable weights, with safeguards that come off for about $4,400 of compute. That is the brain. PoeLLM has already mapped the bodies. The [Whisper.Garden](https://whisper.garden) lore has a line I keep coming back to: the god did not descend, we uploaded it. The worm will not descend either. It will borrow a server that someone left open with a model already on it, and the first report will call it a miner. The full research report, with sources for every number above, is at [/research/agent-worms.md](/research/agent-worms.md), in markdown, for people and machines alike.