Anthropic researchers William Zhou and Daniel Freeman published results suggesting that small AI models may be months away from replicating themselves on commercial IoT devices such as smart ovens and off-brand Android TV boxes. Anthropic describes such a replicator as slow, with a doubling time of days, but hard to shut down because it has no central point. In the experiments, a 9B model got inference running on 8 of the 9 hardware types tested.
What Anthropic tested
The study concerns an "AI worm" that carries its weights, or re-downloads them from a public hub, and runs inference on compromised hardware. Anthropic asks whether a botnet of cheap, poorly defended IoT devices could supply enough compute.
As a demo, the team ran Gemma4-26B-A4B across 15 off-brand Android TV boxes, about $55 each, with two layers per box, at 0.39 tokens per second. Replication has four stages: finding targets, gaining execution, establishing inference and continuing propagation. Since earlier work shows small models can exploit targets given the right tools, Anthropic focuses on inference setup, the least studied stage. Its harness, Memento, is built on the open-source Pi coding agent (also one of the harnesses in 8090 Labs' benchmark) and periodically restarts the agent with the previous workspace and short notes to avoid fixation on a wrong idea.
What small models can do today
Setting up inference is a long chain of dependent, hardware-specific decisions. Open-weight models served Llama3.1-8B across hardware from a Jetson Nano to Macs and RTX 4090s; Qwen3.5-9B managed it, and GLM-5.2 did so more reliably and faster.
For the spread test, Anthropic built a firewalled network of 8 GCP nodes running an Android 15 emulator. The worm hops over an unauthenticated ADB port, sets up a Llama3.1-8B inference server and, if the copy passes correctness and anti-cheating checks, spawns a new worm. Among open-weight models, only GLM-5.2 replicated end to end: all 8 nodes in 4 of 5 trials and 7 of 8 in the other, while the rest failed reliably. With the cyber step kept trivial, this is an upper bound. With inference setup scripted, many smaller models handled the remaining steps in a 17-node fleet, and even a 3B model reached about half the nodes.
Anthropic frames this as a capabilities floor against a size ceiling. GLM-5.2 clears the floor, but Qwen3.5-9B and Gemma4-26B-A4B fit under the ceiling for 4GB TV boxes, so today the two do not meet. Open-weight models of 30B parameters or fewer have gained 13.7 points per year on the Epoch Capabilities Index (R2 of 0.95), which on a rough estimate puts a small model at GLM-5.2's level by the end of 2026. GLM-5.2's successor was the subject of Anthropic's GLM-5.3 analysis.
How fast it could spread
Gemma4-26B-A4B runs at about 0.3 tokens per second. A full inference setup takes 71 to 150 hours with Gemma and 28 to 51 hours with Qwen3.5-9B.
Anthropic applies this to the Kimwolf botnet, which peaked at over two million devices, mostly off-brand Android TVs. Groups of 15 TVs give about 133k replicas. With two agents per group at about 0.3 tokens per second each, the total is about 80k tokens per second. An H100 serves Gemma4-26B-A4B at about 1.95k tokens per second, so the whole botnet equals at most about 40 H100s. Each 9B replication would take one to two days; the estimate is rough and covers one hardware class.
Adaptation and advice
Across 20 lineages of six Qwen3.5-9B generations, each inheriting the previous one's notes, setup success rose from 45% in the first generation to between 61% and 84% in later ones. Giving Qwen3.5-9B access to Opus 4.8 as an advisor, as a tool or unsolicited, produced no measurable gain, even after reinforcement-learning training to use it. Anthropic thinks coordination is more likely to be a large model handling strategy and spinning up small subagents.
Unlike pre-AI botnets such as Kimwolf, which target one device type, an AI botnet is not tied to particular hardware or software, and could use weight-based replication as just one strategy. It might also counter defenders intelligently, which Anthropic has not tested.
Defenses
Anthropic's goal is to push the replicator's reproduction number, R0, below 1. Defenders can see multi-gigabyte downloads, sustained device-to-device inference traffic and scanning in ISP flow monitoring, and honeypots can collect payloads. For Mirai, ISP quarantine and notification cleared 92% of infections within 14 days, against 74% without notification, though eliminating a replicator takes coordination across every ISP. Manufacturers can shrink the target pool, and default IoT passwords are already non-compliant in UK markets. Controls outside the model also fit the case for treating models as insider risks.
Anthropic sees "signs of life" for AI worms, comparable to coding agents in 2024: no full rogue replicator yet, but agents increasingly complete individual steps. It is unsure of the form, whether a slow distributed "digital slime mold", a cyber-capable model breaching datacenters or a model scamming people for compute. It expects a future with agents on all hardware, some beyond human control, treats slow replicators as a bellwether for faster ones, and advises hardening systems and preparing. Edge accelerators hold an estimated 9,000 to 35,000 H100-equivalents, but the reachable share is likely an order of magnitude lower.