Anthropic Shows How Small AI Models Could Replicate Across IoT Devices

Anthropic researchers show how small AI models could autonomously replicate across IoT devices, raising concerns about adaptive, AI-powered botnets.

Anthropic published a paper this week that should make anyone who manages IoT infrastructure sit down for a moment. The research shows that small AI models are approaching the capability to replicate themselves autonomously across networks of cheap, poorly secured devices, the kind of Android TV boxes that sell for fifty dollars on Amazon.

The team ran a 26 billion parameter model, Gemma4-26B-A4B, distributed across 15 off-brand Android TV boxes networked together. It worked. The boxes collectively ran inference at 0.39 tokens per second, slow by any normal standard, but functional, and that’s the point.

The researchers broke autonomous replication into four steps: finding devices on a network, gaining access, setting up the AI model on a new device, and repeating the process. Previous studies had already shown that small models can handle many of the hacking tasks involved. This paper looks at a different question: can a model work out how to run itself on unfamiliar hardware? That’s a key ability for an AI worm that can spread across different devices.

A model with 9 billion parameters successfully set up inference on 8 of the 9 hardware types tested. Models with 30 billion parameters or fewer can already handle many of the individual steps needed for replication, although they still struggle to complete the entire process without errors. In the tests, only one model, GLM-5.2, reliably completed the full process from scratch. It spread to all 8 nodes in 4 out of 5 trials.

The researchers plotted the capability trend of small open-weight models against their release dates and drew a line.

“In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year.” Anthropic states. “Small weight-based replicators may be possible soon after.”

That’s the capability floor for reliable autonomous replication. The ceiling, how small the model needs to be to actually fit on the target devices, is already met by models like Qwen3.5-9B and Gemma4-26B-A4B on standard 4GB TV boxes.

Right now the floor and ceiling don’t overlap. The paper’s estimate is that they will, soon.

Past botnets like Mirai or Kimwolf, which infected over two million Android TV boxes at its peak, were hardcoded for specific device types and specific exploits. An AI-based replicator isn’t tied to any particular hardware or operating system.

“Hard-coded botnets like the Kimwolf botnet each target a specific type of device – in Kimwolf’s case, Android TVs and mobile devices. An AI botnet isn’t tied to any particular hardware or software type, as evidenced by small models being able to set up inference engines on machines from a Jetson Nano to a Mac (see the table in section A).” states the paper. “We expect AI botnets to infect more than IoT devices, and to use weight-based replication as just one strategy in their playbook. AI botnets could also act intelligently to counter defenders, but we haven’t tested this.”

This is exactly what makes it categorically harder to stop than anything a traditional worm can do. A hardcoded worm hits a wall when it encounters an unfamiliar device. A capable agent figures it out.

The spread is slow, taking days rather than hours for each infection cycle. The paper compares it to a slime mold, spreading gradually across a network rather than all at once. This slower pace could make the threat harder to spot. However, the process would still leave signs, including large data transfers between devices that rarely communicate, unusual scanning activity, and continuous traffic between devices.

The researchers also tested whether these models learn as they spread. Each instance keeps notes on what it tried and what failed, then passes those notes to the next copy. A Qwen3.5-9B lineage started at a 45 percent success rate on a setup task and climbed to between 61 and 84 percent across six generations. It’s not dramatic improvement, but it’s real, and it’s the kind of adaptation no traditional malware can do on its own.

Giving the small models access to a more powerful advisor model didn’t help, which is an interesting finding in itself. Small models don’t know what questions to ask, so access to better answers doesn’t move the needle. The paper suggests that coordination is more likely to work the other way, a large model handling high-level decisions while small ones act as its hands across compromised devices.

From the defensive perspective, the paper is clear that this threat isn’t unmanageable, at least not yet. Driving the replication rate below one new infection per existing infection, the same basic math that applies to disease epidemics, is the goal. Network anomaly detection at the ISP level caught the Mirai botnet, and the same approach would flag a weight-based replicator given the sheer volume of data it would move around. One remediation campaign against Mirai cleared 92 percent of infections within 14 days by quarantining infected subscribers and walking them through cleanup.

“Quarantining infected subscribers involved restricting their networks to only being capable of reaching a short whitelist of sites, and otherwise redirecting their browsers to cleanup instructions.” state the researchers. “This cleared 92% of infections within 14 days, against 74% with no notification. We’d expect quarantining to be similarly effective for an initial defense against a weight-based replicator. Eliminating the replicator completely would mean coordinating across every ISP with an infected network, which is difficult.”

Longer term, the paper points to device manufacturers and regulators as the real leverage point. Default passwords that comply with security baselines, mandatory firmware updates, and stricter IoT certification requirements all shrink the pool of targets before any worm gets a chance to scan them. The UK already made default IoT passwords non-compliant. More countries doing the same would matter.

“The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for AI worms.” concludes the paper. “We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, botnet)

---

---