Artificial intelligence researchers are warning the public to use strong passwords and promptly install software updates on their devices to combat “AI-driven computer worms,” a new breed of cyber-threat they say can launch custom attacks on devices, sapping processing power and information as they hunt for new victims.

In June, a University of Toronto team led by Canadian Institute for Advanced Research AI chair Nicolas Papernot announced that publicly available AI models can power a worm capable of adapting its attack on the fly as it spreads between devices connected to the internet, including laptops, printers and cameras. 

The research, conducted in collaboration with the AI development hub the Vector Institute, was shared with “national science, security and defence bodies” prior to its publication, the university said.

Now Papernot, a U of T associate professor of computer engineering and computer science, is warning the public not to ignore or delay prompts to update software, and to change passwords regularly. 

“We can no longer be sloppy with our cybersecurity hygiene,” he said on Thursday at a panel discussion hosted by U of T. 

“We can no longer afford to reuse passwords. We have to use multi-factor authentication. We have to keep our devices up to date, and organizations have to change their processes to make sure that these software patches are deployed as quickly as possible.”

WATCH | Nicolas Papernot shares his research on AI worms:

Worms that learn

Unlike other computer viruses, worms spread from machine to machine without human intervention. The U of T researchers said the worm they created in a lab gathers information as it moves between devices. Every new breach reveals passwords and weak points that can unlock another machine.

In an uncontrolled setting, the researchers say, such a worm could gain internet access and learn from warning notices about newly discovered vulnerabilities, outpacing the software patches meant to stop them. 

“Some of these [issues] can be fixed with software updates. But others are human errors such as weak passwords and sloppy IT setups that can’t be solved by pushing out a patch,” U of T wrote in a blog post about the discovery.

“That means a hacker doesn’t need the most advanced AI models to cause unprecedented damage.”

In 2017, a worm called “WannaCry” wreaked havoc across 150 countries, freezing computers and encrypting files, while demanding a ransom payment in bitcoin. 

Back then, U of T said, this type of attack typically followed a “fixed script” programmed by a human that would often fail when confronted by defensive software it wasn’t designed to crack. 

“The difference here is that the AI-driven computer worms are able to design attack strategies that are specific to each victim device that they interact with. So, rather than use a single vulnerability, they will work and interact with the victim device, and find an attack…

The Federal Aviation Administration has certified the Boeing 737 Max 7, the smallest model in the bestselling family of aircraft, after nearly a decade of delays for safety reviews.

Carriers including Southwest Airlines expected to fly the plane before the pandemic, but increased regulatory scrutiny following the fatal crashes of the in-service Max 8, in 2018 and 2019, other safety and manufacturing crises, and the redesign of an engine anti-icing system delayed certification.

The agency on Monday said the approval “reflects years of sustained work to resolve complex technical issues and complete a thorough review of the airplane’s design and supporting safety analyses.”

Boeing stock rose roughly 8% in afternoon trading Monday.

Airlines can finally start flying passengers soon after planes are certified, but it can take them months to work them into schedules.

The already-built Max 7 planes for Southwest, which make up the bulk of the Max 7s in inventory, will need to be outfitted with the carrier’s new extra legroom seats. Southwest won’t likely start flying the planes until next year.

“This important certification validates the rigor of our airplane’s design and recognizes the determination and resilience of our 737 MAX development team,” Stephanie Pope, president and CEO of Boeing Commercial Airplanes, said in a statement. 

The FAA said it required other changes to the plane beyond the redesign of the engine anti-ice system, including to the flight control software and crew alerting system.

Boeing is also awaiting certification from the FAA of another long-delayed model, the 737 Max 10, which is the largest in the family and one that some carriers expected to start flying in 2020 as well as the manufacturer’s largest plane, the 777X.

The plane maker has about 40 of the 737 Max 7s and 737 Max 10s built and in inventory already, and the FAA approval could help the manufacturer bring in much-needed cash, Jefferies analyst Sheila Kahyaoglu said in a note Sunday. Boeing and other manufacturers receive the bulk of an airplane’s price when they hand it over to customers.

The manufacturer, a top U.S. exporter, has been working to ramp up production of its 737 Maxes and 787 Dreamliners, key to its recovery after years of crisis since airlines and other customers pay the bulk of the aircraft’s price upon delivery. Boeing opened a fourth production line in Everett, Washington, in July for its 737 Max airplanes.

The company has been working to win back the trust of the FAA, and has made strides, including in mid-July, when the FAA said it could once again issue airworthiness certificates for its bestselling 737 Max aircraft and 787 Dreamliners. The agency stripped that from Boeing after the Max 8 crashes, which killed 346 people.

— CNBC’s Michele Luhn contributed to this report.