Researchers found small AI models can already run across cheap edge hardware and complete many of the steps needed for self-replication, raising new concerns about adaptive malware with no central off switch.
Anthropic researchers said Monday that small AI models may be only months away from being able to replicate themselves across commercial IoT devices. That raises the prospect of an AI-powered worm that could keep propagating with no central server for defenders to shut down.
“We don’t yet have a full rogue replicator,” researchers William Zhou and Daniel Freeman wrote in a Monday Frontier Red Team research note, but “we’re seeing signs of life for AI worms.”
Zhou and Freeman tested whether smaller models could set up AI inference on unfamiliar hardware and then complete the steps needed to keep spreading on their own. The unsettling prospect is not simply another computer worm, but one that can reason about unfamiliar devices, adapt its approach and potentially find new ways to keep itself alive as it moves.
The researchers set out to answer the question: Could a small AI model get itself running on unfamiliar hardware and propagate?
Their study focused on what Anthropic calls a near-term “weight-based replicator.” This, according to researchers, is an AI system that compromises a host, establishes inference there and then continues spreading from one machine to the next without human help.
Anthropic said models with just 30 billion parameters or fewer are now small enough to run outside traditional data centers, including on clusters of inexpensive edge devices. Those models can already perform many of the steps needed to replicate themselves, but they still struggle to complete the entire process reliably from start to finish.
For perspective, researchers ran a 26-billion-parameter model across 15 off-brand Android TV boxes costing about $55 each. By Anthropic’s calculation, a 9-billion-parameter model can fit across as few as four devices with 4GB of memory apiece. That is the shift Anthropic is spotlighting. Capabilities once associated with centralized AI infrastructure are becoming portable enough to live on ordinary connected hardware.
How fast? Not very. The 26B model ran across those boxes at 0.39 tokens per second. Anthropic estimates a 9B model would need roughly 28 to 51 hours just to get inference running on a new device. It puts the worm’s doubling time in days, not hours, and compares the result to a “digital slime mold.”
The Edge Cuts Both Ways
The work also highlights both the promise and risk of edge AI, where models run locally on cameras, appliances, robots and other devices instead of relying on the cloud.
The upside to that trend is when AI runs locally it no longer has to depend entirely on expensive centralized GPU infrastructure to perform useful work. A consumer security camera, for example, can increasingly determine on-device whether motion came from a dog, a delivery person or one of your kids without sending every video frame to the cloud for analysis.
That is a privacy win, a bandwidth and computing-resource win, and a latency win. Additionally, devices can keep working even when an internet connection is unavailable.
But the same distributed computing capacity gives attackers a potentially enormous pool of relatively weakly defended machines. Anthropic notes that a growing number of security cameras and video-conferencing units now ship with built-in AI chips. That extra compute, the researchers said, will likely make them attractive targets too.
What Could Possibly Go Wrong?
That is where the research gets creepy.
Anthropic breaks the replication process into four basic steps. One, find a target, gain access, get the AI model running on the new machine, then repeat. In practical terms, that could mean an AI worm lands on one vulnerable device, figures out what hardware and operating system it has found, installs what it needs to run there, then starts looking for the next reachable machine.
Anthropic largely set aside the first two steps, the hacking, because earlier research already shows small models can handle exploits. Its focus was the less-studied part: getting a model running on hardware it has never seen. A 9B model managed that on eight of the nine hardware types tested.
What makes that different from a traditional worm is adaptability. Instead of being hard-coded for one specific device type, an AI-enabled worm could encounter unfamiliar hardware, troubleshoot why its first approach failed, adjust and pass what it learned to the next copy.
Anthropic tested that, too. When successive Qwen3.5-9B instances inherited notes from their predecessors, inference-setup success rose from 45% in the first generation to between 61% and 84% in later ones.
How Close Is Close?
To test the full cycle, researchers built a firewalled network of eight emulated Android nodes and seeded one with a worm. The worm had to find targets, hop over an unauthenticated Android Debug Bridge (ADB) port, copy its payload and get a model running before the next copy launched. Of the open-weight models tested, only GLM-5.2 managed it. It reached all eight nodes in four of five runs and seven in the fifth. The others failed reliably.
Anthropic flags its own caveats. The hacking step was deliberately trivial, which the researchers say makes the results an upper bound on real-world success. The worm also stood up a smaller stand-in model, Llama 3.1-8B, rather than itself.
But the researchers note real IoT compromise may not be much harder. The Mirai botnet spread simply by cycling through default manufacturer usernames and passwords.
Anthropic did not demonstrate an autonomous AI worm loose on the internet. But the researchers argue that the remaining gap is increasingly about reliability, such as getting a model to find a new device, move itself there, start running and repeat the process without making a fatal mistake.
For security teams, that could eventually change the economics of IoT compromise. Traditional botnets generally execute predetermined malware across vulnerable devices. An AI-enabled version could potentially encounter unfamiliar hardware, work out how to use it and adapt as it spreads.
If small models keep improving at their historical rate, Anthropic estimates they’ll reach GLM-5.2’s level by the end of 2026. It calls that a rough projection. Small replicators, it said, may be possible soon after.
The Good News: Worms Are Noisy
A worm like this wouldn’t be quiet. Newly infected devices could pull multi-gigabyte model payloads, and distributed inference would create sustained traffic between devices that normally don’t talk, Anthropic said. Those are anomalies ISPs can catch in flow monitoring. The faster the worm spreads, the louder it gets.
There’s precedent for cleanup. When one ISP quarantined and notified Mirai-infected customers, 92% of infections cleared within 14 days, versus 74% without notification. Anthropic also points to manufacturers. Default IoT passwords are now non-compliant in the UK.
Justin Beals, CEO and founder of compliance firm Strike Graph, said Anthropic “tested the hard part honestly.” He pointed out that the researchers kept the hacking step trivial and called their own results an upper bound.
“The scary headline version of this story will run ahead of the data,” Beals said in an emailed statement to SPB. “Today, a slow worm on cheap hardware is a real but modest threat.”
The bigger exposure, he argued, is an old one. “Mirai spread years ago by trying default manufacturer passwords, and plenty of those devices still sit on networks with nobody accountable for them,” Beals said. “A model that can figure out unfamiliar hardware on its own makes that old governance failure more expensive.”
Most organizations can’t account for every connected device in their buildings, let alone which ones still run factory credentials, he said. “You can’t govern an identity you never provisioned.”
With small models expected to reach this capability by the end of 2026, Beals said, “the window to fix the basics is short.” His list: inventory every device, kill default credentials and watch for sustained traffic between devices that have no business talking to each other.
“That’s continuous monitoring work, and an annual audit won’t catch a worm that spreads between audit cycles,” he said. “Manufacturers should be held to secure defaults now, before the models get there.”
So Much for One Kill Switch
No, the takeaway isn’t that your smart TV is about to become an autonomous AI attacker. It is that AI capability is moving out of the data center and onto the edge faster than many security models were built to accommodate.
And once an AI system is distributed across thousands of inexpensive devices, Anthropic warns, defenders may no longer have one server, or one kill switch, to turn it off.
Nor has Anthropic tested the next step. The researchers say AI botnets could eventually act intelligently to counter defenders, but that remains untested.
Editor’s Note: This article was updated 10/13 with insights from Justin Beals, CEO and founder of compliance firm Strike Graph.
