This finding was the starting point for future research that asked: Would it be possible for small models to create self-replicating infections that run on IoT devices in the same way that traditional IoT worms, such as Mirai, install DDoS code and other payloads? Unlike Mirai, these AI worms could pose a much greater threat, as the models could adapt exploits and payloads dynamically, depending on the target. Once such an infection chain began, it might also become more difficult for defenders to stop it.
“Such an ‘AI worm’ could carry its model weights with it as it plays (or redownload them from a public hub) and then run inference directly on the compromised hardware,” Anthropic said. “Effectively, the weights would become part of the malware’s payload.”
Anthropic called these autonomous worms small weight-based replicators. The models ran agents that had access to common exploitation tools, such as reverse shells. The flow of the attacks was to (1) find targets, (2) gain code execution, (3) establish inferences, and (4) propagate to new hosts. A key benefit over traditional worms is what Anthropic says is the agents’ ability to learn on the job. Every time an AI replicator fails to compromise a specific platform device, it can leave a list of prompts, codes, and notes for future replicators so they don’t waste time reusing the same ineffective steps.
Anthropic said the dynamic inference setup is the least studied and probably the most challenging stage of the replication cycle. It requires a long sequence of decisions based on the specific hardware and software of each target and involves selecting compatible inference software, installing dependencies, and debugging platform-specific errors.
“These steps are serially dependent and it is difficult to recover from failures,” Anthropic said.
The experiment shows that small models are increasingly capable of solving these problems autonomously. At the moment, however, none of the lightweight models tested are capable of mounting end-to-end replication, which means discovering new devices, using an exploit to access them, infecting them with a payload, setting up an inference server, and repeating the process. The process is also painfully slow; Gemma4-26B-A4B, distributed on all 15 Android TV boxes, ran at just 0.39 tokens per second. This translates to a full inference setup time of 71 to 150 hours for a non-optimized Gemma4-26B-A4B and 29 to 51 hours for a Qwen3.5-9B. (The researchers said the large GLM-5.2 model appears to be able to do this reliably.)
