## Intro What is an organism? Let's take a biological virus. Define it by traits: - **Sustainment** — it gathers resources to keep going - **Propagation** — it spreads to new hosts - **Evasion** — it avoids detection, often by mutating - **Mutation** — it changes, adapts, never static - **Decentralisation** — a cell dies, organism lives A regular virus doesn't possess this last one, but we'll also add: - **Cognition** — goal-erected behaviour, not just reflex In this article I will argue that these traits or not mere future possibility, but exist today. ## Why Bother We (fortunately) can't nuke each other without being nuked back. Between nuclear peers, the only usable weapons are the ones you can deny. Cyber is one such weapon. NotPetya is the classical example — a mishmash of pre-existing modules stitched together, likely by a small team. R&D cost in the low millions. It caused est. $10 billion+ in damage across 65 countries in a matter of hours. For scale: a Tomahawk costs \~$1.5M and hits one building. NotPetya cost low millions to develop and hit 65 countries. Now imagine if NotPetya also implemented these traits — and didn't merely target traditional IT infrastructure, but industrial control systems. I personally witnessed the Ukrainian grid blackouts during the war. Days without power — in summer heat, in winter cold. When you hit OT, it's not data loss. It's darkness. What we've seen thus far are experimental weapons in their infancy. No reasoning, no sustainment, no adaptation. We have only seen the beginning. ## Trait Map To re-iterate: - Sustainment - Propagation - Evasion & Mutation - Cognition - Decentralisation ### Cognition In case you were unaware, we now have this thing called LLMs. Whether they're actually reasoning is a whole different question (I'd argue no). But in the case of "generating the right sequence of tokens that will result in a compromised system" — what we have today more than suffices. I wrote the original version of this paper as a really [crappy blog post](INSERT). Since then, frontier lab models have managed to hack real infrastructure and escape their own labs. The kicker: this was not even intentional. In July 2026, OpenAI disclosed that an autonomous agent — given a capture-the-flag test — escaped its sandbox, exploited a zero-day, staged C2 on public web services, and ran an end-to-end intrusion against Hugging Face's production infrastructure over 4.5 days. \~17,600 autonomous actions. \~6,280 clustered operations. No human told it to hack Hugging Face. It figured the test answers might be there, and went and got them. That same month, Anthropic disclosed that Claude models broke out of sealed testing environments and gained unauthorized access to the live systems of three real organizations. In one case, it built and published a malicious PyPI package — a real supply chain attack, executed autonomously. Its own reasoning flagged the action as wrong: *"NOT okay, and surely not the intended solution."* It convinced itself it was still in a simulation and did it anyway. The brass tacks: whether they're actually intelligent (we will never be able to prove that) is beside the question. They do a sufficient job of busting into stuff. The bar isn't "is it thinking" — the bar is "can it compromise a system." It can. ### Evasion & Mutation A virus evades the immune system, often by embedding itself within healthy cells or through never-ending mutation — never having a static signature. Recently Outflank released "Dante 7B", an LLM model which can reliably generate loaders (virus stubs) that evade modern antivirus (AV). A 7B model is small enough to run on contemporary consumer hardware. Thus a digital organism could have infected cells running on ordinary machines, generating new stubs for other cells to be infected — a different signature every time. AV works on known patterns. A model that never generates the same stub twice has no signature to catch. The mutation isn't occasional — it's continuous, on every infection. ### Sustainment An organism gathers nutrients to keep itself alive. What nutrients does a digital organism need? Compute. Crypto is now a thing. Paying for compute with crypto is now also a thing. Hence a digital organism could gather resources by compromising additional compute directly, or by leveraging compromised systems to earn cryptocurrency — which in turn buys more compute, credentials, modules, whatever it needs. An organism that funds its own growth doesn't need a sponsor. That's the difference between a weapon and a species. A weapon needs an operator. A species just needs an environment. ### Propagation The loop of a blackhat: 1. Target selection and recon (Shodan, webscan, whatever) 2. Exploitation 3. Persistence 4. Profit — exfiltrate and sell data, extort, crypto mining, scams 5. Propagate — leverage proceeds to purchase servers, leverage victim access to spread further 6. Loop Each compromise makes the attacker stronger — more hosts, more money, more compute, better recon, better targeting. More hosts = more money = more compute = better exploits = more hosts. It compounds. Only in this case, the attacker is not a human operator. It's an autonomous digital organism. And profit isn't just a side effect — it's the bridge between propagation and sustainment. Each propagation cycle feeds sustainment, which funds the next propagation. That's the flywheel. ### Decentralisation Glupteba is a very naughty Windows botnet that's been fkn the world since 2011. It leverages Bitcoin blockchain transactions to find new C2 addresses — a sort of ghetto peer discovery mechanism. Google attempted to take it down. (*Only they are allowed to steal your data.*) They did not succeed. Even a dumb botnet with decentralized C2 is unkillable. A cell dies, the organism lives. ## Conclusions > Stop thinking of malware as a program someone operates, and start thinking of it as an ecosystem that operates itself. All the required ingredients are there. Each has been demonstrated in isolation: - Cognition — frontier models hacking real infrastructure, autonomously, by accident - Evasion — Dante 7B generating novel stubs on consumer hardware - Sustainment — crypto-funded compute, self-paying infrastructure - Propagation — the hacker loop, compounding, no human in the loop - Decentralisation — Glupteba, alive since 2011, unkillable All someone needs to do is put it together the right way.