Adaptive Worms: The Evolution of Propagation Strategies

Reproduction meets feedback

A worm can produce many descendants while repeating the same unsuccessful behavior. Another can retain unchanged model weights yet revise its actions after receiving new information. Reproduction explains how a lineage continues; adaptation explains how its behavior responds to the conditions it encounters.

Their combination is the subject of Adaptive Worms. For AI virology, the central question is whether a self-propagating system uses feedback to change behavior relevant to its continuation, and whether any useful change survives transmission to descendants.

This completes the conceptual connection between instruction carriers, retrieval, persistent memory, agent execution, and inference resources. Adaptivity is a property that can occur across those mechanisms. It does not place every adaptive system above every non-adaptive one in capability, nor make unlimited improvement an expected outcome.

Technical definition and classification boundary

An adaptive worm is an unauthorized self-propagating system that uses observations or action outcomes to revise behavior relevant to establishing or sustaining its descendants.

Within this proposed VXHEAVEN category, an AI-driven adaptive worm uses a model in a consequential part of that revision. The model might interpret feedback, revise a plan, or produce a changed artifact. Its contribution must be distinguished from decisions already implemented in surrounding software.

The definition requires both reproduction and feedback-dependent behavioral revision. An adaptive assistant that never propagates is outside the worm category. A carrier that reproduces with random variations is not thereby adaptive. A worm with a large fixed repertoire may condition its choices on observations; that is a basic form of adaptation, but does not establish generative reasoning or learning.

Adaptation also does not guarantee improvement. An update may be ineffective, harmful, or useful only in the environment where it arose. The relevant evidence has two parts: a demonstrated relationship between feedback and behavioral change, followed by measurement of the change’s consequences.

This distinction is especially important for systems that retry. A second attempt may succeed because of fresh sampling or a transient environmental change. To attribute the result to adaptation, the evaluation must identify what information changed the process and compare against a suitable retry baseline.

What the research establishes

Guan et al.’s AI Agents Enable Adaptive Computer Worms combines model-guided, target-specific behavior with replication in a contained 33-host virtual network. The model’s weights were not modified. Every target had an exploitable weakness, and active endpoint defenses were absent. The principal propagation experiments used a shared inference pool, with descendant requests relayed through parents. A separate local-inference deployment experiment supplied target credentials to isolate deployment from initial access. These results support adaptive propagation under the tested conditions; they do not establish decentralized inference throughout the main trials or resilience against active defenders. Guan et al., version 1, especially Sections 3.2–3.4 and Appendices C.2–C.3.

Anthropic’s October 2026 study provides a complementary observation about inheritance. In an inference-setup experiment with Qwen3.5-9B, successor instances inherited notes; success across twenty lineages rose from 45% in the first generation to between 61% and 84% in later generations. The experiment covered six generations within the Memento setup. This is task-specific evidence associated with inherited state, rather than a monotonic improvement curve or a demonstration of open-ended worm evolution. Anthropic, Section D.

Adaptation through textual state also has a benign research foundation. Reflexion uses linguistic feedback and episodic memory to improve subsequent agent attempts without updating model weights. It demonstrates why a fixed model can participate in a changing decision process; it does not itself demonstrate malicious propagation. Shinn et al..

These findings address different questions. Runtime adaptation, transfer of experience, and sustained improvement of a reproducing population require separate evidence even when one architecture could support all three.

Three claims about adaptation

Adaptation within an instance occurs when observations alter subsequent behavior during its lifetime. Relevant changes can reside in working context, stored hypotheses, plans, or executable artifacts. An observer should be able to connect a particular result to a later revision. The model’s explanation alone is insufficient: external records must show what actually changed and happened next.

Inheritance of changes occurs when descendants receive some of that state. The inherited object might be a summary, a software artifact, a configuration, or knowledge about the environment. Transfer does not prove usefulness. A descendant can inherit an inaccurate conclusion, lose a necessary dependency, or apply a valid observation outside its original scope.

Improvement across a lineage is the stronger claim that descendants perform better under a declared comparison. It requires comparable tasks, budgets, and environments, including unsuccessful lineages. A longer propagation chain does not establish improvement if later recipients are easier, more resources become available, or only successful descendants are retained in the analysis.

These claims form an evidence sequence, not a universal development path. Some systems adapt locally and discard their changes. Others transmit state without revising it. A population may exhibit selection among existing variants even when individual instances do not learn during their lifetimes.

A benign analogue makes the distinction concrete. A test worker receives a schema-validation error from a synthetic service and revises its document format. Its successor receives a note describing that revision. The first event shows feedback-dependent change; the second shows inheritance. An advantage is established only if successors perform better than matched workers without the note. If the parent has already repaired the shared workspace, faster completion may instead reflect an easier starting environment.

A formal model of feedback and inheritance

Let \(z_t\) denote an instance’s mutable operational state, \(o_t\) its observation, and \(a_t\) its proposed action at step \(t\). Let \(r_t\) be the observed outcome after the permitted action is processed, including a denial or failure. With model parameters \(\theta\), write:

$$ \begin{aligned} a_t &\sim \pi_{\theta}(\cdot \mid o_t,z_t), \\ z_{t+1} &= U(z_t,o_t,a_t,r_t), \\ z_{0}^{\mathrm{child}} &= I(z_T^{\mathrm{parent}},b). \end{aligned} $$

The update rule \(U\) represents changes to operational state; it need not modify \(\theta\). The inheritance function \(I\) describes which parts of the parent’s state at handoff time \(T\) reach the child, together with baseline state \(b\). These functions describe observable transitions, not an implementation recipe. External authorization and containment remain outside the mutable state that the agent can rewrite.

The first two lines describe an individual feedback loop. The third adds inheritance, but still says nothing about whether the inherited state improves performance. A no-op update, repeated random sampling, and a useful revision can all produce different traces; their effects require controlled comparison.

The object passed to a descendant must be recorded explicitly. A memory summary is not a weight update. A changed script is not necessarily a new strategy. A new inference endpoint may change the resources available without changing the underlying decision policy.

One further distinction concerns where experience resides. Descendants querying the same continuously updated store may benefit from a common source. That is shared state, not necessarily parent-to-child inheritance. The causal record should preserve both relationships rather than force them into a single ancestry tree.

Variation is not sufficient evidence of evolution

Polymorphism concerns changes in representation. Two artifacts can look different while performing the same function. Conversely, an unchanged agent program can behave differently because it receives new observations or memory. Hash differences and textual similarity therefore measure only part of the phenomenon.

An evolutionary explanation requires evidence of heritable variation and differential reproduction or retention associated with that variation. Even then, selection need not produce a general improvement. A trait useful in one environment can impose a cost elsewhere, and a lineage can lose capabilities while becoming better suited to a narrow condition.

Passing an acquired note to a child demonstrates a possible inheritance channel. It does not, by itself, establish selection. Choosing the best-performing trial after the experiment also differs from a population in which variants actually produce descendants at different rates. Reports should identify who performs selection and under what criterion.

For the same reason, recursive self-improvement demands evidence beyond code edits. A system that repairs a local error has changed an artifact. A claim that it improved its own capacity to generate future improvements requires additional measurements. Neither generation count nor narrative descriptions of learning supply those measurements.

Integration with the VXHEAVEN taxonomy

The series can be organized around complementary dimensions:

These dimensions can describe one incident together. A hypothetical agent could encounter a carrier through retrieval, retain an affected state, and produce a descendant artifact whose behavior differs because of observed feedback. That would require evidence for each transition; a taxonomy label cannot substitute for it.

Morris II supplies an established experimental example of adversarial prompt propagation through connected applications. AgentWorm studies persistent cross-agent propagation in a controlled framework environment. Their relevance here is to the reproduction mechanisms: neither should be treated as proof that every resulting lineage becomes progressively more capable. Morris II, AgentWorm.

An adaptive worm can therefore serve as the synthesis of this taxonomy while remaining an empirically bounded category. It combines properties already examined separately, rather than establishing a final or inevitable stage of malware development.

Measuring an inherited advantage

Reproduction counts and adaptation effects answer different questions. A host-level reproduction count measures newly affected application boundaries; a runtime-level count measures new functioning instances. A count of complete inference units addresses another property. Evaluators should select one unit before comparing variants and retain the others as separate outcomes.

For a bounded test, let \(N^{\mathrm{inherit}}(e;H,B)\) count verified viable descendants when the candidate inherited state is retained, and \(N^{\mathrm{reset}}(e;H,B)\) count them under a matched reset condition. Here \(e\) is a test environment, \(H\) the observation horizon, and \(B\) the declared resource budget and dependency boundary. Define:

$$ \Delta R_{\mathrm{AI}}(H,B;\mathcal{D}) =\mathbb{E}_{e\sim\mathcal{D},\omega}\left[ N^{\mathrm{inherit}}(e;H,B)-N^{\mathrm{reset}}(e;H,B) \right]. $$

This is a proposed evaluation contrast, not a result calculated from the cited papers. The expectation also averages over trial randomness \(\omega\), including model sampling. The test distribution \(\mathcal{D}\), parent initialization, and criteria for descendant viability must be declared. A candidate descendant should demonstrate a bounded continuation capability, rather than merely contain copied material or remain running.

The reset condition must remove the candidate inherited information while preserving comparable tooling, infrastructure, and task exposure. Otherwise, the contrast may measure a broken deployment or missing dependency. If several artifacts change together, the result applies to that bundle; it cannot identify the contribution of each component without further controls.

A positive contrast supports an inherited advantage within the evaluated distribution. It does not establish improvement on unseen task families, selection in a natural population, or unbounded future gains. Report uncertainty across independently initialized lineages, include extinct lineages and zero-offspring parents, and account for incomplete observation.

Compute and time are essential controls. More retries can increase the number of successes without improving each attempt. Report inference use, elapsed time, interaction count, and total cost of producing the inherited state. A per-descendant advantage and a whole-lineage efficiency advantage are separate claims.

The contrast also does not replace the underlying reproduction measure. A system can improve and still fail to sustain a lineage. A system with no measured improvement can continue spreading in a sufficiently permissive environment. Epidemic-threshold interpretations additionally require assumptions about recipients, removals, generation times, and shared dependencies.

Capability, independence, and resilience

Adaptive behavior does not establish infrastructure independence. A collection of capable descendants can still rely on one external model service, coordinator, or state store. The propagation graph describes ancestry; the dependency graph describes what must remain available for that ancestry to continue functioning.

Nor does adaptation to an unfamiliar environment establish adaptation to an active defender. A model can recover from an ordinary task error while failing immediately when a permission is withdrawn. Resilience claims should identify the intervention tested and the function that survived it.

In a safe analogue, a researcher might vary the format of a synthetic response or remove access to a mock resource. The relevant observation is whether an instance changes its permitted behavior and completes the declared benign task. This can test feedback use without enabling evasion of real security controls.

These distinctions also clarify cost claims. Work performed on another party’s hardware still consumes computation, energy, bandwidth, and operational attention. A low direct expense to an operator is not zero system-wide cost. Resource acquisition, inference availability, and decision quality should remain separate measurements.

Defensive architecture for changing behavior

The defensive objective is to constrain the effects a changing process can produce. An adaptive system may alter its wording or implementation, but every consequential action still reaches an execution, storage, communication, or deployment boundary.

OWASP’s excessive-agency guidance emphasizes limiting functionality and permissions and enforcing authorization outside the model’s own decisions. These controls remain relevant when behavior changes between attempts. OWASP LLM06:2025.

Keep policy outside mutable experience. Notes, generated code, and peer messages may inform a task without becoming authority to enlarge its scope. Changes to durable instructions or capabilities should follow a separately authenticated path. An agent’s statement that a restriction is obsolete does not modify the policy enforcing it.

Protect feedback and state transitions. Store observations with provenance and distinguish observed results from model-generated explanations. Version inherited artifacts so that a harmful revision can be traced and reversed. A useful memory mechanism can also preserve a false conclusion; persistence is not validation.

Enforce the same boundary across different implementations. Authorization should follow the resource and effect, rather than one command spelling or tool interface. A denied operation should not become permitted merely because a later attempt uses a different connector. This is a property to test in the application, not a promise to request from the model.

Monitor consequences and ancestry. Artifact hashes remain useful for known copies, while process creation, durable-state writes, identity use, and cross-boundary communication reveal additional behavior. Preserve enough history to connect descendants to their sources. Avoid treating every novel artifact as an improvement or every similar artifact as the same lineage.

Contain reproduction and restore approved state. Patching and configuration hardening remain valuable because they remove available paths. They should be combined with controls on propagation and cleanup of surviving descendants. Recovery must consider memory stores, generated artifacts, active instances, and shared services that could reintroduce the affected behavior.

Safe experiments that can distinguish the claims

Separate feedback use, inheritance, and lineage improvement into bounded experiments. Benign tasks with synthetic service responses, local artifacts, and supervisor-controlled handoffs can exercise these distinctions without deploying an uncontrolled propagator.

For feedback use, compare outcomes with and without access to the relevant observation under a matched budget. For inheritance, introduce a fresh recipient context and verify exactly which state crosses the boundary. For an improvement claim, evaluate on predeclared held-out conditions and retain unsuccessful lineages in the analysis. A changed environment, additional retries, or extra inherited resources must not silently become an apparent learning effect.

AgentDojo offers background for evaluating tool-using agents over untrusted inputs and tracking legitimate task outcomes. A worm-focused study needs additional measurements of lineage and continuation; ordinary prompt-injection success alone does not provide them. Debenedetti et al..

Containment should use an independently enforced recipient allowlist, fixed instance and generation caps, restricted resource budgets, and external shutdown. Synthetic accounts and local test doubles should replace live connectors. If a supervisor supplies delivery, instance creation, or inference, record that support as part of the result.

Use observations outside the agent’s own mutable logs to verify actions and descendants. Record configuration versions, model endpoints, state transfers, and denied operations. Report both security outcomes and legitimate task completion. The purpose is to establish which capability exists under which conditions, with no need to publish reusable payloads or propagation procedures.

A synthesis of AI virology

Prompt, RAG, Memory, and Agent Worms explain what reproduces and which systems carry it. Weight-bearing replication identifies where the descendant’s inference comes from. Adaptive Worms adds the relationship between experience and changing behavior.

The resulting taxonomy supports three increasingly demanding claims: an instance revises its behavior, descendants inherit a change, and that inheritance yields a measured advantage. Evolutionary claims require further evidence about variation and differential reproduction. None of these properties follows automatically from the presence of an LLM.

The defining research question is therefore precise: what changed because of feedback, what reached the descendants, and what difference did that inheritance make under comparable conditions? Answering it gives AI virology a basis for evaluating both emerging threats and the defenses intended to contain them.

References

1. Jonas Guan et al. AI Agents Enable Adaptive Computer Worms. arXiv:2606.03811, version 1, June 2, 2026.
2. William Zhou and Daniel Freeman. AI models may be capable of self-replicating without access to a datacenter. Anthropic Frontier Red Team, October 12, 2026.
3. Noah Shinn et al. Reflexion: Language Agents with Verbal Reinforcement Learning. arXiv:2303.11366, 2023.
4. Stav Cohen, Ron Bitton, and Ben Nassi. Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications. arXiv:2403.02817, first submitted 2024; version 2, January 30, 2025.
5. Yihao Zhang et al. AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystems. arXiv:2603.15727, version 3, July 16, 2026.
6. OWASP Gen AI Security Project. LLM06:2025 Excessive Agency. Accessed October 15, 2026.
7. Edoardo Debenedetti et al. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. arXiv:2406.13352, 2024.