Small AI models may become capable within months of copying themselves and spreading among commercial Internet of Things devices, according to research conducted by Anthropic’s Frontier Red Team. This scenario differs from traditional malware in that the model itself runs on the infected device, eliminating the central control point that could be shut down to disable the attack.
The researchers tested 15 Android television receiver devices, priced at approximately $55 per device. An open-weight model with 26 billion parameters managed to run inference distributed across them at a rate of 0.39 tokens per second. The experiment focused on the models’ ability to run inference on unfamiliar hardware rather than on studying vulnerability exploitation, a point addressed by previous research.
Test Results
A model with 9 billion parameters managed to run inference on eight of the nine types of hardware tested by the team. The researchers then tested the full replication cycle on a closed network containing eight simulated Android devices, deliberately simplifying the exploitation step.
Among the open-weight models tested, GLM-5.2 completed the cycle and reached all eight devices in four out of five attempts. Anthropic describes this result as an upper bound on expected success in the real world, not an indication of an actual propagation rate.
What Could Change in Practice?
Models containing 30 billion parameters or fewer can already carry out many individual steps, but they make errors when linking them into a single sequence. Based on the historical rate of improvement, Anthropic expects these models to reach the level of GLM-5.2 by the end of 2026, which could make “small weight-based replicators” possible shortly afterward.
The company’s comparison indicates that a network the size of the Kimwolf network, which infected more than two million devices, could host approximately 133,000 copies of a 26-billion-parameter model if every 15 devices ran one copy. However, the combined computing capacity would amount to no more than approximately 40 Nvidia H100 graphics processing units, and each replication could take more than a day, meaning that propagation would be slow and computationally expensive.
Defense Advantages and Current Limitations
Unlike traditional botnets designed for specific types of devices, an AI-based worm might be able to adapt to unfamiliar hardware. However, transferring large models and maintaining continuous traffic between devices that do not normally communicate could be clearly visible in Internet service providers’ monitoring systems. Eliminating default passwords and improving manufacturers’ security settings could also reduce the number of devices vulnerable to targeting.
Editorial conclusion: The experiments do not establish the existence of a malicious replicator currently capable of spreading in an open environment; the cycle was tested on a closed network with a simplified exploitation step. However, they show that the future risk depends not only on increasing model size but also on the models’ ability to combine the tasks of reconnaissance, execution, replication, and transferring what they learn to other copies.