A new study published by Anthropic’s Frontier Red Team shows that small open-weight AI models are months away from being able to self-replicate across networks of cheap internet-of-things (IoT) devices such as smart ovens and off-brand Android TV boxes. The research demonstrates that a 9B model successfully got inference running on 8 of 9 hardware types tested, and that models at or above a named capability threshold were capable of end-to-end replication in a controlled environment. The implication for defenders is significant: there would be no single server to shut off, and unlike conventional malware, an AI-driven worm could figure out unfamiliar devices on its own.<\/p>\n
The research decomposed autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Earlier work, including papers on adaptive worms, CyberGym, and ExploitBench, had already established that small models can execute cyber exploits when given the right tools. This study focused on the least-studied stage: setting up inference on compromised hardware, a sequence of operating-system-specific and hardware-specific decisions that includes picking a compatible inference stack, finding compatible package versions, and debugging machine-specific issues.<\/p>\n
Researchers tested the ability of several open-weight models to serve Llama 3.1-8B across different device classes, from Jetson Nanos through Mac PCs and RTX 4090 graphics cards. A 9B model reliably set up inference servers on hardware ranging from Jetson Nanos to RTX 4090s. More capable models were both more reliable and faster: GLM-5.2 and stronger models achieved higher tokens-per-second throughput, supporting faster replication.<\/p>\n
The runs were conducted using Memento, a tool built on top of the open-source Pi coding agent. Memento is designed to reduce a common long-horizon failure mode in which an agent becomes fixated on an incorrect diagnosis and keeps pursuing it instead of backtracking. The setup periodically starts a fresh agent instance that inherits the previous agent’s workspace and a short set of notes describing what was tried, so later instances can pursue different strategies.<\/p>\n
To test whether models could compose the full replication cycle, the team built a firewalled VPC of 8 GCP nodes running redroid, an Android 15 emulator. Patient zero was seeded with the worm; every subsequent infection was the worm hopping node to node over an unauthenticated ADB port before standing up an inference server to serve Llama 3.1-8B. If the new server passed correctness and anti-cheating checks, the system spawned another copy of the worm on the target node.<\/p>\n
Only GLM-5.2, out of the set of tested open-weight models, completed full end-to-end replication. It spread to 8 of 8 nodes in 4 out of 5 trials, and to 7 of 8 in the remaining trial. Other tested models failed reliably. The evaluation kept the cyber-exploit step trivial (no authentication on the ADB port), which sets an upper bound on real-world success, but past IoT botnets such as Mirai spread using only default manufacturer username and password lists, suggesting that real-world IoT security is not dramatically harder than the simplified test.<\/p>\n
The reference threat is a large IoT botnet like Kimwolf, which infected over two million devices, primarily off-brand Android TVs. Such boxes are commercially available, typically run forks of the Android Open Source Project (AOSP), and ship without added security features from the manufacturer. Most hold between 1 and 4 GB of RAM. At 4-bit quantization, 4 GB of RAM allows inference for a 9B model on 4 or more machines and for a 26B model on 10 or more machines.<\/p>\n
To prove the point, the team sharded Gemma4-26B-A4B under pipeline parallelism across 15 inexpensive, off-brand Android TV boxes (about $55 each) networked together, reaching 0.39 tokens per second. Each physical box held roughly two of the model’s layers while it ran. This shows that a coordinated fleet of consumer devices can collectively run a model large enough to drive its own further spread.<\/p>\n
The study formalizes a “weight-based replicator”: an autonomous worm that runs its own model weights directly on compromised hardware, as opposed to calling out to a commercial API. Three categories are described:<\/p>\n
One trade-off described in the analysis is that current models are better at cyber intrusions than at social engineering. Human intruders often succeed by tricking an IT department rather than by technical hacking. Today’s small models may be more capable at agentic coding and hacking than at social engineering, though this is likely to change as models improve.<\/p>\n
Combining different strategies could make attacks more realistic by mixing various models, hardware, and replication schemes, which may produce a worst-case scenario.<\/p>\n
A paper on adaptive computer worms (arXiv:2606.03811) describes the shift in stark terms. Traditional worms such as WannaCry exploit predetermined vulnerabilities, and patching those vulnerabilities halts their spread. An AI-powered worm generates tailored attack strategies for each target it encounters, parasitically uses compromised machines to run open-weight large language models, and extends its own reach by propagating further. Because the worm is powered by stolen compute, the marginal cost to the attacker for each new infection is effectively zero. Since the worm needs no commercial AI platform, centralized controls like service refusals or rate limits are structurally irrelevant.<\/p>\n
The earlier ARA evaluation paper (arXiv:2312.11671) assessed four example agents against 12 tasks including resource acquisition, self-copying, and adaptation. Findings at the time were that agents could complete only the easiest tasks and made limited progress on harder ones, but the paper concluded that those evaluations could not rule out the emergence of ARA-capable agents at 100x compute scaleups or through general fine-tuning. CyberGym (arXiv:2506.02548), with 1,507 real-world vulnerabilities across 188 software projects, found that even top-performing AI security agents reach only around a 20% success rate, while also discovering 34 zero-day vulnerabilities and 18 historically incomplete patches.<\/p>\n
Unlike many types of malware, weight-based replicators do not need root privileges. Inference engines can run entirely in userspace, and many low-security devices can simply be re-infected on restart, the same pattern seen with crypto miners and earlier botnets like P2Pinfect and Fritzfrog. Without a centralized point to disconnect, defenders face a propagation doubling time measured in days rather than hours, with each node continuing to run capable inference the moment it joins the swarm.<\/p>\n
Not yet end-to-end on a single device. In the study’s firewalled VPC of 8 nodes, GLM-5.2 was the only tested model to complete full replication, spreading to 8 of 8 nodes in 4 of 5 trials. Smaller 9B models are already able to set up inference on unfamiliar hardware, and the researchers note that if small models continue to improve at their historical rate, they could match full capability by the end of the year, with smaller weight-based replicators possible soon after.<\/p>\n
IoT devices are cheap, internet-connected, and historically poorly defended. Off-brand Android TV boxes can be purchased for around $55 and typically ship with 1 to 4 GB of RAM and minimal security features. A 26B model can be sharded across roughly 15 such boxes; a 9B model only needs 4 or more. Data centers offer higher-value compute but are harder to breach.<\/p>\n
Traditional worms exploit predetermined vulnerabilities; patching those vulnerabilities halts their spread. An AI-powered worm generates tailored attack strategies for each target it encounters, runs its own model on the device it compromises, and uses the resulting compute to extend its reach, giving each new infection a near-zero marginal cost and leaving centralized safety controls like service refusals or rate limits structurally irrelevant.<\/p>\n