Self-replicating worm

A self-replicating worm is a malicious program that copies itself and sends those copies on to other computers. What makes it special: it needs no human being to do so. Nobody has to open a file or click on an attachment. The worm itself searches the network for further machines and exploits security holes there, that is, programming errors that let it break in without authorization. This is why a worm can spread across the entire world within hours. The name dates back to the 1970s and describes how such a program “burrows” through a network.

Why worms grow faster than any countermeasure

The danger of a worm lies in how it multiplies. One infected machine infects several more, and each of those infects several more again. This doubling is called exponential growth. In just a few hours, a single computer can turn into hundreds of thousands. Humans who need to react are simply too slow for that.

A well-known example is WannaCry from 2017. Within a few days, the worm infected around 200,000 computers in more than 150 countries. Among those affected were British hospitals, which had to cancel operations, and Deutsche Bahn, whose display boards failed. The damage is estimated at several billion euros. The worm encrypted files and demanded ransom.

For stock markets and companies, this is a real financial risk. A worm can halt production plants, cripple logistics, and render customer data unusable. Insurers therefore offer dedicated cyber policies. And governments now treat such attacks as a matter of national security.

From break-in to the next copy

A worm operates in three steps. First, it searches for reachable machines by systematically probing addresses on the network. Then it tries to break in there. Usually it exploits a known security hole or a weak password to do so. If it succeeds, it copies itself onto the new machine and starts over from the beginning there.

A worm often also carries an additional malicious function along with it, which experts call the payload. This can be data encryption, spying on passwords, or enlisting the machine into a botnet, that is, a network of remotely controlled computers. The spreading and the actual damage are technically separate parts. A worm without a malicious payload still clogs up networks, simply through its own traffic.

Worms and viruses are often confused with one another. A virus attaches itself to an existing file and only becomes active if a human runs that file. A worm is a standalone program and spreads on its own. That is why the most effective defense is to install security updates quickly, since they close precisely the holes that the worm needs.

AI agents as a new breeding ground for worms

In the news, worms usually surface after major outages. When clinics, ports, or car plants suddenly grind to a halt, such a piece of malware is often behind it. The term Stuxnet also comes up regularly: around 2010, this worm damaged centrifuges in Iranian nuclear facilities. It is considered the first case in which software deliberately destroyed physical machinery.

The topic is being newly discussed because of AI systems that carry out tasks autonomously and, in doing so, read emails or invoke programs. Researchers have shown test setups in which a specially crafted message causes such a system to send that same message on to further contacts. That is the basic idea of a worm, just in text form instead of program code. No market-ready attacks of this kind are known so far, but the risk is being taken seriously.

In everyday life, people encounter protection against worms far more often than the worm itself. Automatic updates for Windows, Android, or the router are exactly this kind of defense. Corporate IT departments also split networks into segments so that a worm cannot reach everywhere. The principle is reminiscent of watertight compartments on a ship: a leak should not flood the entire vessel.