The world's first computer virus didn't steal data or lock screens
In 1971, engineer Bob Thomas created Creeper, an experimental self-duplicating program on the ARPANET. It was not malicious; it simply printed the message "I'M THE CREEPER: CATCH ME IF YOU CAN!" on DEC PDP-10 screens before moving to the next system. Creeper inspired Reaper, created soon after to track down and delete Creeper, effectively becoming the world's first antivirus software.
An Experiment in Autonomous Network Mobility
In 1971, computer networking was in its infancy. The Advanced Research Projects Agency Network, known as ARPANET, connected a modest number of research institutions, universities, and military laboratories across the United States. At Bolt, Beranek and Newman (BBN)—a technology company deeply involved in building and maintaining ARPANET infrastructure—computer engineer Bob Thomas began experimenting with a fundamental computing question: could an active computer program move itself from one machine to another across a network while continuing its execution?
To test this concept, Thomas wrote a program named Creeper. The target environment was the DEC PDP-10 mainframe computer running the TENEX operating system, a popular time-sharing platform among early ARPANET nodes. Creeper was not conceived as a weapon, a prank, or an exploit, but rather as an exploration of distributed computing and mobile software agents. At the time, computers operated largely as isolated silos, and demonstrating that a running process could jump across network links was a significant technical milestone.
How Creeper Moved and Manifested
Creeper functioned by locating another machine running the TENEX operating system on ARPANET, establishing a connection, and transferring its code across the link. Once transferred, the program initiated execution on the remote system. To confirm that the migration had succeeded, Creeper printed a short, playful message to the terminal screen or teleprinter: "I'M THE CREEPER : CATCH ME IF YOU CAN!"
Crucially, the original version written by Thomas did not aim to spread uncontrollably or flood the network. In its initial design, Creeper moved rather than multiplied: as it migrated to a new PDP-10 host, it would suspend and delete its presence on the originating computer. The program carried no destructive payload, altered no user files, and consumed minimal resources beyond what was needed to output its text and search for the next network destination.
From Relocation to True Replication
The behavior of Creeper evolved when Ray Tomlinson, a colleague of Bob Thomas at BBN who is also recognized for implementing network email on ARPANET, took an interest in the project. Tomlinson modified Thomas's original code to alter its transmission mechanism. Instead of removing itself from the source host after jumping across the network, Tomlinson's version created a duplicate copy on the target machine while leaving the original instance running.
This shift from relocation to self-replication transformed Creeper from a nomadic program into a self-propagating entity. As copies of Creeper spread between TENEX machines across ARPANET, multiple instances could inhabit different nodes simultaneously. While still entirely harmless in intent, the multiplying instances demonstrated the potential for automated code to proliferate across a connected network without central coordination.
Reaper: The First Antivirus Countermeasure
With multiple copies of Creeper now residing on connected systems, Tomlinson developed a companion program called Reaper to manage them. Reaper was designed with a single objective: to navigate ARPANET in the same manner as Creeper, identify running instances of the Creeper code, and terminate them.
Reaper moved from system to system across the network, tracking down Creeper processes and deleting them from the host machines. In doing so, Reaper established the conceptual foundation for automated antivirus and anti-malware software. Just as Creeper was the first self-replicating network program, Reaper was the first autonomous security agent engineered specifically to locate and neutralize unwanted software across a distributed network.
The Classification Debate: Virus or Worm?
In popular culture and historical retrospectives, Creeper is frequently labeled the world's first computer virus. Within computer science, however, the terminology is more nuanced. Formal definitions of malware distinguish between a virus, which attaches itself to an existing executable file and relies on host execution or user action to spread, and a worm, which runs independently and propagates across network connections without attaching to existing programs.
Because Creeper operated autonomously over network links and did not infect host executables, many modern security researchers classify it as the earliest prototype of a computer worm rather than a strict virus. When Creeper was created in 1971, neither term had yet been formalized in computer security literature—the academic definition of a computer virus would not be established until the 1980s. Regardless of modern taxonomical distinctions, Creeper stands as the earliest recorded demonstration of self-propagating code traversing a digital network.
The Trust-Based Environment of Early Networking
The emergence and benign nature of Creeper reflect the unique social and technical architecture of the early ARPANET. During the early 1970s, network access was limited to a small community of vetted researchers, engineers, and academics who operated under an assumption of mutual trust. System boundaries were permeable, and security controls such as robust access restrictions and payload scanning were largely nonexistent.
In this collaborative climate, Creeper and Reaper served as harmless, insightful experiments that illuminated the possibilities of networked automation. They highlighted that connected systems could not only exchange passive data files, but could also host active, self-directed code that migrated and acted across physical distances—laying the groundwork for both modern distributed computing and the discipline of network security.
Key takeaways
•Created in 1971 by Bob Thomas at BBN, Creeper was an experimental program designed on ARPANET to test whether code could autonomously move between DEC PDP-10 systems running TENEX.
•Ray Tomlinson later modified Creeper to duplicate itself rather than merely jump between machines, making it the first truly self-replicating network program.
•Tomlinson also created Reaper, an autonomous program that moved across ARPANET to find and terminate Creeper instances, effectively serving as the first antivirus software.
•While often called the first computer virus, Creeper operated as a standalone network-propagating process, aligning more closely with the modern definition of a computer worm.