Original editorial illustration.
The story of Creeper and Reaper sounds like science fiction: one program travels through a network, and another follows to remove it. Yet this happened in the early ARPANET era, long before consumer antivirus products or today’s malware industry. The original motivation was technical experimentation, not extortion or data theft.
An experiment in moving software
At Bolt Beranek and Newman (BBN), Bob Thomas investigated whether a running program could migrate between machines while preserving its state. Early Creeper work used PDP-10 computers and the TENEX operating system, both characteristic of the first networked research environments.
Unlike modern malicious worms, this was a deliberately constrained demonstration of computer mobility. In a later account, Thomas described the experiment and Ray Tomlinson’s involvement in extending it.
From movement to replication
Tomlinson changed the behavior so that the program could copy itself to another computer rather than simply moving away from the original. That difference is fundamental: copying allows multiple instances to exist and potentially spread.
Creeper became associated with a playful message — “I’m the Creeper: catch me if you can.” The specifics varied across descriptions, but the larger point was clear: code had become something that could propagate over a network.
The program that followed
Reaper, commonly credited to Tomlinson, used related ideas to locate and remove copies of Creeper. It is often called a conceptual ancestor of antivirus software, though comparing a research experiment from the early 1970s directly to a modern security product can be misleading.
The exchange foreshadowed a familiar security pattern: a new capability appears, and a countermeasure emerges that must understand that capability to contain it. The relationship between software behavior, privilege and network trust remains relevant.
The long shadow of a small experiment
The Morris worm of 1988 was a later and much more disruptive event. It demonstrated how network reachability and software defects could turn replication into widespread operational harm.
Today we think about segmentation, privilege boundaries, detection and response. Creeper and Reaper offer a safe historical starting point: how does a networked system know which programs should be allowed to move, replicate or remove others?
Sources & Further Reading
Historical references are linked for independent reading. Interpretations and original artwork are editorial.