While worms and viruses are nothing new, in many ways their destructive impact has been limited by the command and control capabilities of the people manning them. You could hack a couple thousand end users' desktops with an SMB 0-day, but so what; it's not like you can actively try and pivot off of each of their privileges, except in a programmatic way. Now, with AI agents, you actually can.