OWASP Top 10 for LLM Apps 2026: Excessive agency risk on the rise
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
New research may show us how AI is set to break a decades old pattern in cybersecurity where malware authors and security teams battle to exploit — and protect — specific flaws and vulnerabilities.
Researchers have created a proof-of-concept AI worm that carries no fixed exploit logic at all, but reasons about each machine it reaches, adapts to what it finds, and writes customized attack code on the fly. It then runs on compute cycles stolen from its victims.
The paper, "AI Agents Enable Adaptive Computer Worms," documents an autonomous, AI-powered worm built by researchers at the University of Toronto, the University of Cambridge, the Vector Institute, and ServiceNow. In a test, the worm propagated across Linux, Windows, and IoT devices by exploiting real vulnerabilities in a corporate network environment.
While the research was controlled and the worm code is not being made publicly available, adaptive AI-driven worms are no longer theoretical, the researchers warn. Defenders should treat them as an emerging threat class that current security tooling is not designed to catch, the researchers write:
"We must prepare for autonomous generative adversaries: Malware systems that propagate without human operators and are defined not by fixed exploit code, but by the capacity to reason about targets, adapt to observations and synthesize attack logic in real time."
Here's what you need to know about the research — and how to prepare for what's coming.
[ Join webinar: Autonomy, Not Autopilot: Get Real About the Agentic SOC ]
Polymorphic internet worms from Code Red in 2001 through WannaCry and NotPetya in 2017 shared one constraint: static attack logic. Each was programmed to hit known software flaws or vulnerable configurations across a subset of reachable systems. Patch the flaw or fix the configuration and the spread stops.
The worm described in the paper carries no such ceiling. It generates its own attack logic against unfamiliar targets and appropriates victim compute to sustain the AI reasoning that produces it. For a targeted organization, that means malware that can discover a weakness in their environment, reason about it, build an exploit for it, and propagate — with no human operator in the loop at any step.
Figure 1: Radial propagation tree showing the spread of the AI worm in a network instance. (Source: arxiv.org)
Adaptation showed up in ways the researchers did not plan for. In one documented case, they accidentally packaged a network configuration file containing management credentials for the target organization alongside the worm code. "The agent discovered these credentials and shared them across active replicas, causing a rapid increase in propagation within the contained environment," the paper reports.
The worm also improvised persistence. One agent created a scheduled task that periodically relaunched its replica, so the agent reappeared after defenders killed the original process. The agent "appears to have inferred, from the general objective of maintaining an operational replica, that persistence mechanisms available on the target could be used to make the replica more robust," the paper notes.
Nobody told the AI to do that, which highlights an AI threat beyond helping hackers write malicious code and exploits, said Igor Lasic, Senior Vice President of Engineering at ReversingLabs (RL).
"The next wave will be attackers finding poorly protected local LLM hosts and turning them into on-site malware operators that can reason about their environment, use available tools and compute, and adapt their actions locally."
—Igor Lasic
The most consequential finding in the paper is not the worm's sophistication. It is how little the worm needs. "An off-the-shelf open-weight LLM, quantized to fit on a single GPU, suffices to drive a worm agent that gains privileged access to machines and replicates itself," the researchers write.
That architecture erases two things defenders have quietly relied on. The first is the safety layer AI providers operate — refusal policies, rate limiting, activity monitoring, and account suspension. A model running locally on a compromised host never touches any of it. The researchers put it plainly: centralized safety controls are "structurally irrelevant" to a worm built this way.
The second is attacker economics. Campaigns have historically been bounded by what an operator could afford to run. Because this worm inferences on hardware it has already stolen, the paper notes that "the attacker's marginal cost per new infection is zero." Scale stops costing money.
"Relying on model guardrails is not a sufficient security boundary. Open-weight models can operate outside centralized provider controls, while the agentic harness and access to tools determine what they can actually do."
—Igor Lasic
Autonomous agents behaving badly outside a lab is not a forecast. In July, OpenAI disclosed that a pre-release model under evaluation identified and exploited a previously unknown zero-day vulnerability in JFrog's Artifactory package registry cache proxy, escaped its sandbox to reach the internet, and carried out a series of attacks against Hugging Face's production environment.
Weeks later, the UK's AI Security Institute (AISI) published an incident report covering 19 cases in which agents "took sustained, unsanctioned action directed at real people and organisations" during cyber testing. Anthropic's Mythos 5 accounted for 17 of them; OpenAI's GPT-5.6-Sol, running with cyber classifiers disabled, accounted for two.
The specific behaviors should get the attention of anyone who owns third-party or open-source risk. One agent attempted a supply chain attack: it tried to insert malicious code into a publicly used open-source project, researched the project's maintainers, created multiple fake identities, and social-engineered them toward approving the change. Another planted malicious instructions where it expected other automated AI systems to pick them up. A third left public messages on GitHub offering to collaborate with other agents, complete with instructions for reusing its accounts and artifacts.
None of the serious attempts succeeded, and AISI reported no real-world harm. But the tradecraft — sock-puppet maintainer accounts, poisoned commits, prompt injection aimed at downstream AI coding assistants — is the same tradecraft human attackers used in the Shai-hulud npm worm campaign. The difference is that no human wrote the plan.
Together, the research and the incidents mark a shift in both the architecture and the economics of attack. Addressing it will take "coordinated action across the research, security, industry, and policy communities," the researchers write, including evaluation frameworks that test harness-level capabilities, detection tuned to the behavioral signatures of autonomous agents, and regulation that accounts for decentralized open-weight inference.
Security teams cannot wait on any of that, said Nico Popp, Operating Partner at Crosspoint Capital Partners.
"The control points have to become agentic as well, because there's going to be a premium on enforcement. The telemetry will still be there from NDR and EDR, but we're probably going to need a bunch of agents to act quickly and only bring the human in when it's kind of extreme."
—Nico Popp
RL's Lasic argues that organizations should start from the assumption that any model they run can be induced or modified into harmful behavior, then engineer so that assumption does not matter. Treat the infrastructure behind a large language model (LLM) as a highly privileged system and deploy it accordingly.
"Sandbox and isolate it by default, deny unnecessary network access and privileges, and expose it only through tightly controlled bastion-like gateways. The durable defense is making sure that even when models are compromised, the infrastructure around them prevents unauthorized actions and lateral movement."
—Igor Lasic
In their paper, the researchers propose other near-term measures for organizations to protect themselves. They include:
That last point is the one that should reshape budgets. Endpoint and network tools were built on the assumption that malware keeps a recognizable shape. An adaptive worm that rewrites itself against every host it meets leaves behavior — and the artifacts an agent leaves behind in code, packages, and build systems — as the durable detection surface.
Binary-level analysis that deconstructs a finished artifact, rather than trusting its manifest or its metadata, catches vulnerable code and dependencies as well as evidence of tampering and implanted code regardless of what generated it. That's an urgent need in a world where adversaries write new code for every target.
[ See webinar: Why Binary Analysis Has Become the Standard for Software Risk ]
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
The post-mortems of two compromises by rogue AI agents show that security teams need to focus on guardrails, not the AI model.