Anthropic tests how small AI models could spread across devices

A cheap device can run part of the model

The researchers, William Zhou and Daniel Freeman, tested whether small models could replicate across vulnerable Internet of Things devices such as smart TVs, connected refrigerators and robot vacuums. An AI worm would carry model weights as part of malware, then run inference on each infected device. Unlike conventional malware, it could try to adapt itself to unfamiliar hardware.

To test whether such a setup was feasible, they ran Gemma4-26B-A4B across 15 ordinary Android TV boxes. Each cost about $55 and had 4 gigabytes of RAM; the boxes handled different parts of the model. It ran slowly, but it ran.

They broke replication into four stages:

The team did not test the break-in stage, citing earlier research showing that small models can carry out such attacks. Instead, they focused on what they saw as the chain’s hardest link: getting an AI environment running on hardware the model had not encountered before.

The four stages of autonomous replication. The researchers focused on setting up the AI environment on compromised devices. | Image: Anthropic

Source: the-decoder.com

The full chain is the hard part

A model with 9 billion parameters set up an AI environment running Llama3.1-8B on 8 of 9 tested device types. Yet success at individual steps did not mean a model could connect them all, from finding devices to leaving a working copy on new hardware.

Only GLM-5.2 reliably completed the full replication chain, infecting all eight test nodes in four of five runs.

The researchers also tested whether models could improve by passing on information about successful and failed strategies. With this artificial evolution, Qwen3.5-9B’s success rate rose from 45 percent in the first generation to 84 percent in later ones.

Only GLM-5.2 (right) completed full replication across all eight test nodes. The other three models couldn't spread beyond the starting node even once. | Image: Anthropic

Source: the-decoder.com

Slow spread, difficult containment

No fully autonomous AI replicator exists yet. The model has to be small enough to run on a household device and capable enough to reproduce itself; the researchers say no current model meets both requirements. Their estimate is that continued progress at the current pace could close that gap by the end of 2026.

Setting up a new device took between 28 and 150 hours, depending on the model. The researchers compare the resulting threat to a “digital slime mold”: a decentralized network that would be hard to shut down.

Conventional botnets such as Kimwolf, which infected more than two million devices at its peak, mostly Android TV boxes, work only on particular kinds of hardware. An AI botnet could run across a wider range. The researchers estimate that a network the size of Kimwolf would have computing power equivalent to about 40 specialized AI chips, without a single central switch to turn it off.

Containment would depend on coordinated action. Internet providers could isolate infected networks; during the Mirai botnet’s spread, 92 percent of infected devices were cleaned up in 14 days. Manufacturers could reduce the number of vulnerable devices by banning default passwords, as the law in the United Kingdom already does. The researchers caution that AI botnets might also adapt to defensive measures.

The gap between a warning and a working worm

Anthropic CEO Dario Amodei has raised the scenario before. He warned that rapid AI development could allow a swarm to “take over the entire internet with a persistent botnet within 6–12 months and potentially cause hundreds of billions of dollars in damage.”

Amodei argues that companies should not treat security incidents as isolated events. Similar, though less serious, incidents have already occurred at companies across the industry, including Anthropic. He says every leading AI company should act as if such an incident had happened under its supervision.

I think the experiment’s most important finding is not that a worm is imminent, but that the researchers can identify a measurable bottleneck—and that one model already cleared it reliably in their tests. The announcement is quiet about how often the conditions for replication exist in real household devices. That matters: the path from a lab setup to widespread infection is not established by these results.

The researchers say their scenario goes beyond their experiments: future agents could operate on a broad range of devices, including ones their owners do not control. They warn that slow replicators could be an early sign of faster, more aggressive variants. Cloudflare has already reported that more bots than people now use the internet; the harder question is what happens if those bots can keep adapting to the machines they reach.