Bruce Schneier wrote this week that researchers have prototyped an internet worm that carries its own language model and runs inference on the boxes it owns. He called it the closest thing yet to John Brunner’s 1975 vision. He’s right, and the timing is uncomfortable, because in the same news cycle JFrog confirmed two self-spreading npm campaigns (IronWorm and a new Miasma variant) and Microsoft Threat Intelligence published a prompt injection pathway in the Claude Code GitHub Action that lets attacker-controlled text reach into CI/CD secrets. The autonomous-propagation story is back on the cybersecurity menu, and it’s wearing a suit and tie this time.

Worms never really went away. They just got polite enough to call themselves “supply chain attacks” so everyone could keep using the word “ransomware” at board meetings. What’s different in mid-2026 is the substrate. Worms are no longer hopping between Windows hosts on port 445. They’re hopping between npm packages, GitHub Actions, and yes, language models that can read code and decide where to go next.

Three stories, one shape

Look at the three reports side by side and the thread is impossible to miss.

JFrog’s writeup describes IronWorm and a refreshed Miasma riding more than fifty npm packages, with one camp scraping every secret it can find on a developer’s box and hiding behind an eBPF rootkit, and the other self-spreading through the package graph. Microsoft’s analysis of the Claude Code GitHub Action shows how a crafted issue body could coax the agent into exposing workflow secrets, which under the right conditions means the action effectively writes its own exfil step. And the academic AI worm prototype Schneier highlighted carries its model with it, so the propagation logic isn’t a static payload, it’s a small reasoning loop running on the victim.

Three different substrates, three different blast radiuses, one structural property. The thing that decides where to go next lives on the compromised system, not on a static C2 lookup table somewhere. That’s the trait that defined the Morris worm. It is the trait that’s coming back.

The blast radius the old playbook misses

The classic worm response was perimeter. Block the port, patch the service, watch the firewall. That’s not where the new propagation happens. IronWorm rides into your house through the package-lock.json your developers wrote last sprint. The Claude Code GitHub Action gets compromised through an issue comment that no human reviewed before the agent acted on it. The AI worm prototype, conceptually, treats every box with outbound internet and a few GB of free RAM as the next hop.

None of those paths involve your edge firewall.

This is why the comfortable corporate cyber security posture (centralized EDR on managed endpoints, vendor signature feeds, quarterly tabletop) is increasingly answering yesterday’s question. The hops that matter are developer laptops with admin shells, GitHub Action runners with overly broad scopes, AI agents wired to repository write access, and the npm and PyPI mirrors that all of those things pull from without much thought. Most of those surfaces don’t have a clear owner inside the average mid-market org. Some of them aren’t even on the asset inventory.

The threat detection problem changes shape too. There’s no fixed binary to hash, no domain to block at DNS, and increasingly no consistent network fingerprint. A worm that uses an LLM to decide what to do next can vary its behavior per host. Your IOC feed becomes wallpaper.

What to actually do this quarter

The defensive moves aren’t novel. The novelty is in who owns them and how seriously you treat the surfaces.

• Inventory the install path. Every npm/PyPI/Maven/NuGet registry your org pulls from, every CI runner, every AI agent with repo or cloud credentials. If you don’t have a list, you can’t defend it.
• Pin and verify dependencies. Hash-pin production lockfiles, block postinstall scripts at the runner level by default, and require publisher verification for new transitive dependencies. The OWASP CVE Lite CLI that landed this week is one free option for fast vulnerable-dependency scanning, and there’s no excuse not to wire it into pre-commit and CI.
• Scope CI/CD credentials. No long-lived secrets in repos. OIDC federation to cloud providers, ephemeral tokens, and per-job least-privilege. The Claude Code GitHub Action incident is a textbook reason to audit which actions in your org can read which secrets.
• Treat AI agents as code execution. If an agent can read an issue body and call a tool, the issue body is an instruction. Sandbox the tool calls, separate the agent that talks to humans from the agent that touches infrastructure, and require human approval for write paths to production.
• Baseline egress on build runners. First-time-seen destinations from a build agent should fire an alert. Worm propagation almost always reaches out before it spreads.
• Brute-force controls on the surfaces nobody talks about. Registry mirrors, internal Git, package proxies, container registries. Tools like Fail2ban or IPBan Pro on these endpoints aren’t glamorous, but a worm that has to backoff after five failed auths is a worm that’s a lot easier to spot.
• Rehearse the incident response. Run a tabletop where a poisoned npm package landed in production a month ago. Walk through revoke, rotate, rebuild. If your team blanks on step three, fix that now.

None of this is new doctrine. It’s just defense in depth applied to the surfaces where work actually happens in 2026, instead of the ones that were important when the playbook was written.

The verdict your CISO doesn’t want to hear

If you’ve spent the last decade hardening Windows endpoints and tuning your firewall, you’ve solved a problem that’s no longer the one that matters most. The autonomous, registry-borne, agent-mediated worm is back, and it’s better at picking targets than the 1988 version. It also has a degree of judgment, which is a word nobody expected to use about malware.

This isn’t a panic story. The fundamentals (asset inventory, scoped credentials, egress visibility, brute-force throttling on adjacent auth, rehearsed IR) still work. They just need to apply to package registries, CI runners, and AI agents, not only to laptops and domain controllers. Security hardening has moved up the stack. Some teams have moved with it. Most haven’t. The ones that don’t are going to discover that “supply chain attack” and “worm” are the same word in two different decades.

Bruce was right to call the AI worm cool. It’s also a preview. Plan accordingly.

Sources

• AI Worm (Schneier on Security)
• IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks (The Hacker News)
• Securing CI/CD in an agentic world: Claude Code GitHub Action case (Microsoft Security Blog)
• OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds (SecurityWeek)