Small AI ‘worms’ could soon be capable of replicating across internet-connected devices without relying on data centres, raising the prospect of persistent botnets that exploit poorly secured consumer hardware.
Anthropic researchers William Zhou and Daniel Freeman warned that smaller models could reach the capabilities needed for autonomous replication by the end of 2026, if improvements continue at their historical rate.
“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices,” they wrote in a study published by Anthropic this week.
The researchers tested whether AI agents could identify targets, establish inference on unfamiliar hardware and propagate across a network. They found that, although models can complete many individual steps, reliably combining them into a complete replication process remains challenging.
Zhou and Freeman ran the Gemma4-26B-A4B model across 15 inexpensive Android TV boxes, each costing about $55 and equipped with 4GB of RAM. By distributing the model across the devices, they achieved inference speeds of 0.39 tokens per second.
“Expensive accelerators aren’t strictly necessary,” the researchers wrote, demonstrating how relatively cheap hardware could collectively provide the computing resources needed to run an AI model.
In a controlled network of eight emulated Android devices, the GLM-5.2 model completed the replication sequence, reaching all eight nodes in four out of five trials.
However, the experiment used an unauthenticated Android Debug Bridge port, making the initial compromise deliberately straightforward. The results do not demonstrate that an AI worm can independently breach and spread across the public internet.
The researchers also found that a 9bn-parameter model could establish inference on eight of nine hardware types tested, suggesting that smaller models are becoming more capable of adapting to unfamiliar computing environments.
The findings come as cyber attacks highlight the risks posed by insecure connected devices. This week, refrigeration systems at hundreds of French supermarkets were compromised, allowing attackers to raise temperatures and spoil food. French authorities said the incident affected older refrigeration control systems, including equipment from Danfoss and Copeland.
The incident was not linked to AI, but illustrates how vulnerable connected equipment can be exploited to disrupt physical operations. The researchers warned that AI-powered malware could introduce a different threat by using compromised devices to host models and propagate to further targets.
Unlike conventional botnets, which typically target particular devices or known vulnerabilities, an AI worm could potentially adapt to different hardware and software environments.
The researchers found that passing information between successive AI instances improved their ability to configure inference. In tests, Qwen3.5-9B’s success rate rose from 45% in the first generation to between 61% and 84% in later generations after instances inherited notes about previous attempts.
Replication would initially be slow on low-cost hardware. The researchers estimated that setting up inference and replicating Qwen3.5-9B could take about 28 to 51 hours under their test conditions.
They described the potential threat as a distributed “digital slime mould”, spreading gradually across networks rather than rapidly overwhelming them.
Unusual network activity, including large model downloads, unexpected communications between devices and network scanning, could help defenders identify infections. Internet service providers could quarantine compromised devices, while manufacturers could reduce exposure through stronger default security settings and timely software updates.
There’s plenty of other editorial on our sister site, Electronic Specifier! Or you can always join in the conversation by visiting our LinkedIn page.
