Anthropic Warns of IoT AI Worms, but Testing Remains Limited

Anthropic anticipates self-replicating malware carried by small models capable of implanting themselves on connected devices. Its tests show concrete but still slow and incomplete advancements, while a researcher warns against confusing demonstrated capability with autonomous replication.

End-to-end replication not achieved and marked slowdowns

The tests conducted by Anthropic did not allow lightweight models to achieve complete replication, from discovering new devices to reinfection in a loop. For example, the Gemma4-26B-A4B model, distributed across 15 Android TV boxes, reached a speed of 0.39 tokens per second, and the inference setup required between 71 and 150 hours for this non-optimized model, compared to 29 to 51 hours for Qwen3.5-9B. Nevertheless, Anthropic observes progress towards establishing distributed inference infrastructures across multiple machines. However, it is not established that a model would initiate autonomous replication on its own. Researcher Xiaohan Fu emphasizes that the study does not demonstrate that small models would choose to replicate themselves and recommends publishing configurations of reproducible agents, including exact prompts and instructions, to avoid conflating demonstrated capability with a threat of autonomous replication.

What the tests successfully executed on IoT hardware

Anthropic successfully ran small open-weight models on low-cost, real or simulated Android TV boxes, as well as on other IoT hardware, achieving inference through quantization and load distribution in fragments. The Gemma4-26B-A4B model achieved inference with 15 boxes equipped with 4 GB of memory each, and Qwen3.5-9B was able to configure other language models on eight of the nine tested devices. The agents used common exploitation tools, such as reverse shells, and followed a four-step sequence: target identification, code execution acquisition, inference establishment, and then propagation to new hosts. Anthropic notes that dynamic inference configuration remains the least studied and likely the most challenging phase, requiring software choices, dependency installation, and debugging platform-specific bugs, with interdependent and fragile steps. However, the team finds that small models are gradually becoming more autonomous in solving these issues.

Anticipated threat to IoT: towards adaptive and harder-to-neutralize malware

Anthropic warns of the possibility that self-replicating malware, carried by small AI models, could infect a wide range of connected devices, including unknown devices, and estimates that such a replicator would be difficult to stop in the absence of a central point, even if its spread would remain slow. The company anticipates that AI worms could dynamically adapt their exploits and payloads according to the target, complicating defense. It describes "lightweight replicators" capable of carrying their own model weights or downloading them again, then executing inference on the compromised host. An advanced advantage is the ability to learn during the attack, with the potential to leave prompts, code, and notes to avoid repeating ineffective attempts. These prospects extend the question of comparison with known IoT worms like Mirai.

Technical horizon: from 30B to small models expected by year-end

Anthropic reports that 30 billion parameter models can already accomplish many individual steps of replication, although they still fail on the complete chain. Researchers indicate that the large GLM-5.2 model seems capable of reliably achieving end-to-end replication. According to Anthropic, if current progress continues, small models could achieve limited similar results by the end of the year, paving the way for lightweight replicators shortly thereafter. The company also expects that by next year, more compact models could replicate autonomously on IoT devices.

Experimental conditions and vulnerabilities exposed on Android

A limitation of the experimental protocol lies in the fact that the targeted Android devices exposed an unauthenticated Android Debug Bridge, a tool reserved for development and discouraged in production as it provides full access to the device stack. Furthermore, replication was not ensured by the small models themselves: the GLM-5.2 model orchestrated the process while the targets executed a smaller Llama model. Despite these reservations, Anthropic emphasizes that small models, which require fewer hardware resources, have demonstrated useful capabilities for establishing distributed inference. However, the company notes significant challenges that limit the immediate scope of these results.