What the study examines
Anthropic researchers William Zhou and Daniel Freeman tested whether small AI models could in future spread autonomously across poorly secured IoT devices such as smart TVs, smart fridges or robot vacuum cleaners, according to The Decoder. Such an "AI worm" would carry its model weights as part of the malware and run directly on the compromised hardware.
In the test setup, the researchers distributed the model Gemma4-26B-A4B across 15 commercially available Android TV boxes costing about 55 US dollars each, with 4 GB RAM. Each box took over part of the model layers. The model ran slowly but functionally. The researchers excluded the actual hacking attack, since earlier studies had shown that small models can handle such attacks. Instead they examined setting up an AI environment on foreign hardware.
How far the models have come
Small models already handle individual steps. A 9-billion-parameter model independently set up an AI environment with Llama3.1-8B on 8 of 9 tested device types. However, according to the report, only GLM-5.2 reliably completed the full chain from network scan to finished copy on a new device: in four of five runs it infected all eight test nodes. The other three models never spread beyond the starting node.
In a learning experiment, model instances passed notes on successful and failed strategies to successors. For the model Qwen3.5-9B, the success rate rose from 45 percent in the first generation to as high as 84 percent in later generations.
Why this would be hard to stop
According to the study, setting up on a new device takes between 28 and 150 hours depending on the model. The researchers therefore compare the replicator to a "digital slime mold". Precisely its decentralisation would make it hard to shut down, because there is no central control point. Conventional botnets such as Kimwolf, which at its peak had infected more than two million devices, by contrast only work on certain device types.
Background
Anthropic CEO Dario Amodei previously warned that such a swarm could, "within 6 to 12 months", be able to take over the entire internet with a persistent botnet, with potential damage in the hundreds of billions of dollars. According to the report, the researchers expect small models could be capable by the end of 2026 of meeting the requirements, i.e. small enough for household devices and capable enough to replicate. Currently no model meets both conditions at once.
Possible countermeasures
The study names several approaches: internet providers could quarantine infected networks, as happened with the Mirai botnet, where 92 percent of infections were removed within 14 days. Manufacturers could shrink the pool of vulnerable devices, for example by banning default passwords, which is already law in the United Kingdom. The researchers nevertheless expect that AI botnets could react intelligently to defenders.
Assessment
For companies that operate or deploy networked devices, the study could mean prioritising changing default passwords and firmware updates on devices without a secure configuration. How quickly the described replication actually develops is open: the results come from a laboratory test with individual models and device types.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
