This finding was the starting point for further research that asked: Would it be possible for small models to create self-replicating infections that run themselves on IoT devices the way traditional IoT worms, like Mirai, install DDoS code and other payloads? Unlike Mirai, these AI worms could pose a much higher threat, since the models could tailor exploits and payloads dynamically, depending on the target. Once such an infection chain began, it might also be harder for defenders to stop it.
“Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware,” Anthropic said. “Effectively, the weights would become part of the malware payload.”
Anthropic called these autonomous worms small weight-based replicators. The models ran agents that had access to common exploitation tools, like reverse shells. The flow of the attacks was (1) finding targets, (2) gaining code execution, (3) establishing inference, and (4) propagating to new hosts. A key benefit over traditional worms is what Anthropic described as the agents’ ability to learn on the job. Each time an AI replicator fails to compromise a specific platform device, it can leave a list of prompts, code, and notes to future replicators so they don’t waste time reusing the same ineffective steps.
Credit: Anthropic
Anthropic said the dynamic inference setup is the least studied and likely most challenging stage in the replication cycle. It requires a long sequence of decisions based on the specific hardware and software of each target and involves selecting compatible inference software, installing dependencies, and debugging platform-specific bugs.
“These steps are serially dependent, and failures are difficult to recover from,” Anthropic said.
The experiment shows that small models are becoming increasingly capable at solving those problems autonomously. At the moment, however, none of the lightweight models tested are able to mount end-to-end replication — meaning discovering new devices, using an exploit to gain access to them, infecting them with a payload, configuring an inference server, and repeating the process. The process is also painfully slow: Gemma4-26B-A4B, distributed over 15 Android TV boxes, performed at just 0.39 tokens per second, translating to a full inference setup time of 71 to 150 hours for an unoptimized Gemma4-26B-A4B and 29 to 51 hours for Qwen3.5-9B. The researchers noted that the larger model GLM-5.2 appears capable of completing the full replication cycle reliably, underscoring that the threat will grow as capable models continue to shrink.
