The first computer virus was fought by the first antivirus
In 1971, computer engineer Bob Thomas created Creeper, an experimental program that hopped between mainframe computers across ARPANET, printing the message: "I'm the creeper, catch me if you can!" To remove it, internet pioneer Ray Tomlinson wrote Reaper, a program designed to replicate across the network, find Creeper, and terminate it. Reaper became the world's first digital antivirus software, created specifically to counter the world's first worm.
An Experiment on the Early Network
In the early 1970s, ARPANET was a fledgling packet-switching network connecting research institutions, military sites, and universities across the United States. Engineers at Bolt Beranek and Newman (BBN), a research and development firm in Cambridge, Massachusetts, were deeply involved in building and refining the core software and hardware that made this interconnection possible. Among them was computer engineer Robert (Bob) Thomas, who was investigating distributed computing and exploring whether an active software process could move autonomously between separate physical mainframes.
The computing environment of the era was radically different from modern personal computing. Thomas worked with Digital Equipment Corporation PDP-10 mainframe computers running the TENEX operating system. Networks at the time were not built with defenses against hostile software because access was restricted to a small community of academic and government researchers. In this collaborative environment, connected nodes served as a testing ground for experimental programs and novel inter-machine communication protocols.
How Creeper Hopped Across Systems
In 1971, Bob Thomas wrote a program named Creeper to test the feasibility of autonomous process migration. Rather than remaining anchored to a single terminal or host computer, Creeper used ARPANET connections to transfer itself from one PDP-10 to another. Once it successfully reached a remote system, it displayed a brief, taunting message on the destination terminal: "I'm the creeper, catch me if you can!"
In its original form, Creeper was not designed to multiply endlessly or fill up storage. Instead of creating copies across the network, the original version was designed to migrate. The program gathered its state, established a connection to another host running TENEX across ARPANET, transferred its code over the network, began running on the new machine, and removed its presence from the previous host. It was a functional demonstration that an active computational task could relocate itself across networked machines.
Replication and the Creation of Reaper
The experimental program soon caught the attention of Ray Tomlinson, another prominent BBN engineer who would become widely known for implementing the first networked email system and introducing the use of the "@" symbol in addresses. Tomlinson took Thomas's concept and modified Creeper's code. In Tomlinson's version, Creeper did not simply jump from one machine to the next while deleting its prior instance; instead, it duplicated itself, leaving a running copy behind on each machine it visited while propagating new instances across ARPANET.
To manage and remove the self-replicating versions of Creeper, Tomlinson authored a second program called Reaper. Built on the same mobility mechanics that allowed Creeper to travel between hosts, Reaper was programmed to hop through ARPANET, scan active processes on connected PDP-10 systems, locate running instances of Creeper, and terminate them. In doing so, Reaper acted as an automated remediation tool—becoming the first piece of software written specifically to seek out and neutralize another program across a network.
Worm, Virus, or Autonomous Agent?
Creeper and Reaper are frequently described in retrospective accounts as the first computer virus and the first antivirus program, but the terminology of computer security was not yet established in 1971. The terms "computer virus" and "worm" were not used by Thomas or Tomlinson at the time. The concept of a computer virus was formalized years later, notably in academic research by Fred Cohen in the 1980s, while the term "worm" was adapted from science fiction into computer science literature by researchers at Xerox PARC at the end of the 1970s.
Technically, Creeper's self-contained propagation makes it closer to what is now classified as a network worm rather than a classic virus, which typically attaches itself to an existing host executable file. Crucially, Creeper lacked malicious intent. It did not encrypt files, damage operating systems, exfiltrate private data, or corrupt storage. Its only noticeable effect was displaying its message and consuming network bandwidth and processor time during migration.
The Legacy of Mobile Code
Though created as a benign demonstration, Creeper and Reaper illustrated fundamental principles that would define computer networking for decades to come. They showed that open network architectures could allow programs to propagate and execute without requiring manual intervention at every terminal. This demonstrated the immense potential of distributed computing, where tasks could balance themselves across multiple machines, while simultaneously revealing how easily unauthorized software could traverse an interconnected system.
Reaper established the basic conceptual model of automated digital defense: an independent tool that navigates systems, identifies specific foreign code signatures or process behaviors, and removes them. What began as a collaborative experiment between two engineers on a handful of research mainframes established the foundational dynamics of self-propagating software and automated cybersecurity defense.
Key takeaways
•Bob Thomas created Creeper in 1971 on BBN's PDP-10 mainframes running TENEX to test autonomous process migration across ARPANET.
•Ray Tomlinson modified Creeper to replicate itself rather than just jump, and subsequently created Reaper to track down and terminate Creeper instances.
•Neither program was malicious; Creeper was an experiment in distributed computing, and the terms 'worm' and 'virus' were applied to it only retrospectively.
•Reaper established the core concept of antivirus software by functioning as an automated tool designed to detect and eliminate unauthorized running processes.