Picture a teletype in a lab at BBN Technologies in 1971. It rattles to life and prints a line nobody typed: «I’m the creeper, catch me if you can!» By the time you read it, the program that wrote it is somewhere else on the network, ready to pull the same trick on the next machine.
That line came from Creeper, almost certainly the first program to move from one computer to another on its own. Close behind it came Reaper, the first program written to hunt it down. Both were born in 1971 at BBN Technologies, the company that built a big part of the network that grew into the internet. Neither did any damage, because both were experiments. In that detail you have two origins at once: the origin of the malware that came later, and the origin of the industry built to fight it.
Here is the idea that makes this story worth your time. Any new capability in computing turns into a threat the moment somebody decides to use it badly. That sentence is the story of Creeper and Reaper, and we are still repeating it half a century later. A harmless demonstration in 1971 opened the door to an entire category of programs. Some of what you have heard about these two is documented, and some is legend. The difference matters, because they are the reason we call anything the first worm and the first antivirus.
The setting: a young network and an old idea
The backdrop is ARPANET, the research network that the US Department of Defense’s advanced projects agency brought online with its first link in 1969. By the early seventies it was already joining research centres and universities, and people were testing ideas on it that would later shape the internet. The Computer History Museum dates to 1971 both Ray Tomlinson’s networked email and the choice of the «@» symbol you still type today.
The idea of a program able to copy itself was not new either. The mathematician John von Neumann had worked it out in the 1940s, inside his theory of self-reproducing automata, published as a book in 1966. What was missing was not the theory. It was a real network, big enough to test it on.
And that is where BBN comes in. Bolt, Beranek and Newman was the company behind the equipment that connected ARPANET, and in its laboratories engineers were developing TENEX, an operating system for the DEC PDP-10. One of its programmers, Robert «Bob» Thomas, was working on a project called Resource Sharing Executive (RSEXEC), a pioneer of what you would now call a mobile application: a program that hops from one machine to another in order to run wherever there are spare resources. SANS’s Internet Storm Center reconstructs that origin from period sources, and first-hand accounts from those years were collected in IEEE Annals of the History of Computing.
What Creeper was
In 1971 Bob Thomas wrote Creeper, the demonstration program for that project. It ran on TENEX across PDP-10 machines, and it did something new for the time. It executed on one computer, printed a message, and then jumped to another machine on the network, erasing itself from the one it had just left. That was the practical proof you could send a program travelling on its own between different computers.
It was tested on no more than 28 computers linked to ARPANET, always with the agreement and cooperation of their operators, and with no negative effects. Creeper did not damage files. It did not steal data. It made no attempt to go unnoticed. It was, in SANS’s words, the first example of a computer worm, and it was completely benign.
The message: «I’m the creeper, catch me if you can!»
The only trace Creeper left behind was a line printed on the teletype of the machine it had «visited»: «I’m the creeper, catch me if you can!». The name came from the climbing plant that tangles and spreads, and the message, half in jest, worked as both an introduction and a challenge. Do not dig for a hidden meaning here. That kind of humour belonged to the laboratory culture of the day, where proving something difficult was usually celebrated with a joke.
What Reaper was
Not long afterwards, Ray Tomlinson, the same BBN engineer who had just picked the @ sign for email, wrote a version of Creeper that could copy itself instead of merely hopping from one machine to the next. That change mattered. The original always left a single copy on the network. Tomlinson’s version could live on several machines at once. With that behaviour it already looked like what we now call a worm.
Because the program now multiplied, Tomlinson wanted to be sure that no glitch left loose copies dangling on some system. So he wrote Reaper: a program that walked the same 28 machines and killed any instance of Creeper it came across. The name says it all if you think like a gardener. If creeper is the climber, reaper is the pruner. For that job of seeking out and deleting another program it is considered, with caveats, the first antivirus in history.
The attribution is not settled. Some accounts hold that Reaper was Bob Thomas’s work, others that it was Tomlinson’s. The most widespread version, and the one that fits their own testimony, points to Tomlinson.
Virus, worm or antivirus? The vocabulary problem
In 1971 neither the word «virus», applied to computing, nor the word «antivirus» existed. The term computer virus did not arrive until 1984, when Leonard Adleman coined it from the experiments of his student Fred Cohen. And the worm model, understood as a program that spreads across the network by itself, was formally described in 1982 in a paper by John Shoch and Jon Hupp published in Communications of the ACM.
That is why calling Creeper «the first virus» is convenient and imprecise at the same time. Here are the pieces, with the label you would give them today:
| Program | Year | Author | What it did | Label today |
|---|---|---|---|---|
| Creeper | 1971 | Bob Thomas (BBN) | Moved from machine to machine across ARPANET and erased itself from the previous one | Primitive worm (it did not replicate) |
| Creeper (Tomlinson’s version) | 1971 | Ray Tomlinson (BBN) | Copied itself and could exist on several machines at once | Worm |
| Reaper | 1971 | Ray Tomlinson (attributed) | Walked the machines and deleted the copies of Creeper | Antivirus / «nematode» |
The underlying distinction is still the one that separates a worm from a virus. A worm spreads by itself, with nobody opening anything. A virus needs to hide inside a file and wait for someone to run it. Creeper, in its original version, did not even multiply. It relocated. Only with Tomlinson’s modification did it start to behave like a textbook worm. As for Reaper, SANS proposes a more precise term than «antivirus»: a nematode, a worm whose whole job is to eliminate another worm.
That boundary between «virus», «worm» and «malware» is the one worth keeping clear if you do not want to defend yourself the wrong way. You can work through it, with types and examples, in what a computer virus actually is.
The legacy: from one experiment to an industry
The chain that starts with Creeper never stopped. In 1982 Elk Cloner spread between Apple IIs through boot floppy disks. In 1986 Brain became the first PC virus by travelling on copies of MS-DOS. In 1988 the Morris worm was the first serious internet-wide incident. What in 1971 had been a laboratory demonstration on 28 machines had become, in under two decades, a national security problem.
The legacy cuts two ways. Creeper proved that a program could move by itself across a network, an idea that today underpins everything from distributed computing to the bots that automate routine tasks. Reaper opened up the defensive logic that still holds: if something can spread, you need another tool to detect it and stop it. From that came antivirus software, and from that, in time, the endpoint detection and response (EDR) platforms that now watch over entire networks. The NIST glossary today carries formal definitions for all that vocabulary that did not exist in 1971.
To understand how we got here it is worth looking too at the culture that surrounded those pioneers, the same culture that, decades later, produced the people who go looking for flaws in systems. You will find the context in what a hacker really is and in the history of computing.
Frequently asked questions
What was the first computer virus in history?
Creeper, in 1971. Technically it was more a worm than a virus: it moved from one machine to another across ARPANET and erased itself from the previous one, without replicating and without causing harm. The word «virus» was not coined until 1984, and the first PC virus, Brain, arrived in 1986.
What is the difference between a worm and a virus?
A worm spreads across the network by itself, with nobody opening anything. A virus has to hide inside a file and wait for someone to run it in order to copy itself. Creeper, especially in Tomlinson’s version, behaved like a worm.
Who created Reaper, the first antivirus?
The most widely accepted attribution is Ray Tomlinson, the BBN engineer who also chose the @ sign for email. Some accounts point to Bob Thomas, the author of Creeper, and no definitive record settles the question.
Was Creeper dangerous?
No. Creeper was a harmless experiment: it damaged no files, stole no data, and it ran with the permission of the operators of the 28 machines that took part in the test. Its only trace was the message «I’m the creeper, catch me if you can!» printed on the teletype.
Why is Reaper called the first antivirus?
Because it was the first program designed to seek out and delete another program that was spreading. SANS refines the point: more precisely, it was a «nematode», a worm dedicated to hunting another worm. The idea of a defensive tool separate from the system is exactly the idea behind the modern antivirus.
The bottom line
Creeper and Reaper fit into one sentence. One experiment proved a program could travel across a network on its own, and the other proved you had to be able to stop it. Neither did any harm, and neither was called «virus» or «antivirus» at the time. Yet both fixed the pattern that has run computer security ever since, where every new capability can be turned to a good use or to harm, and the sooner you understand the second possibility, the better prepared you are.
So the next time someone tells you Creeper was the first virus, correct them. It was the first worm. The word «virus» would not be coined for another thirteen years, and a piece of software almost nobody remembers was already hunting it down before either name existed. That is a better story than the one you started with, and now it is yours to tell.