Press play to start listening
Anthropic finds small AI models can set up inference servers across different hardware, raising concerns about future AI worms targeting connected devices.
AI research firm Anthropic warns that small AI models can set up inference servers across diverse hardware, raising concerns that AI-powered malware could eventually spread from one device to another on its own.
Such systems could self-propagate and spread across connected devices, including inexpensive Android TV boxes and other Internet of Things (IoT) equipment, running on compromised hardware without relying on centralized infrastructure.
Testing AI Worm Capabilities
In a recent study, Anthropic examined whether AI models could deploy themselves on unfamiliar hardware and propagate across networks. Models with 30 billion parameters or fewer can already complete many individual steps needed for autonomous replication, although combining them reliably remains a challenge.
A 9-billion-parameter model, Qwen3.5-9B, successfully set up inference servers on eight of nine tested hardware types, ranging from Jetson Nano devices to systems equipped with RTX 4090 graphics cards. Inference means running a trained model to generate outputs.
Researchers also distributed the Gemma4-26B-A4B model across 15 inexpensive Android TV boxes costing about $55 each. Using pipeline parallelism, which splits a model’s layers across multiple devices, the cluster generated 0.39 tokens per second.
The team tested replication across eight Google Cloud nodes running Android 15 emulators. GLM-5.2 was the only tested open-weight model to complete the simulated process, reaching all eight nodes in four of five trials. The test used an Android Debug Bridge (ADB) port without authentication, making it easier for the model to access other devices. This means the results do not show that an AI worm could spread on its own across real-world networks.
Anthropic expects smaller models to reach similar capabilities by the end of 2026 if current progress continues. This is an estimate, not a confirmed timeline.
How AI Worms Could Adapt
Researchers found that models performed better when they passed notes about earlier attempts to the next instance. For Qwen3.5-9B, the success rate for setting up inference rose from 45% to between 61% and 84% over later generations. This suggests future AI worms could learn from earlier attempts and work more effectively on unfamiliar hardware.
Giving Qwen3.5-9B access to a more powerful AI model, Opus 4.8, did not improve its results significantly. The smaller model struggled to ask useful questions, and advice provided without being asked did not help either.
Detecting and Containing AI Worms
Anthropic estimates that setting up inference could take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. This could make AI worms much slower to spread than conventional malware, with replication taking days rather than minutes. This creates unusual network activity that security teams can detect, including large model-weight transfers, sustained traffic between devices and unexpected network scanning.
Network service providers can counter these threats by identifying abnormal traffic flow, isolating infected devices on restricted networks, changing unsafe default settings and removing easy-to-guess passwords, Anthropic notes.
Researchers stress that fully autonomous AI worms have not yet been demonstrated in real-world attacks. However, advances in AI and the growing computing power of everyday devices could make such malware possible in the future.
Experts Warn of Emerging AI Worm Threat
John Gallagher, Vice President at Viakoo, a Mountain View, said connected devices have long been targets for botnets because of weak security practices.
“This is different – traditional botnets are static scripts. Anthropic’s experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails,” Gallagher told Hackread.com.
Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, stressed that the experiments demonstrated individual capabilities rather than a fully working AI worm.
“Anthropic tested models under orders to replicate, not models choosing to. The propagation test ran on emulated devices, and the model steering the worm, Zhipu AI’s GLM-5.2, ran on a separate server because the emulated devices were too small to hold it. Anthropic says it has no full worm yet, and its end-of-2026 projection rests on what the report calls a proxy metric,” Hogue-Spears told Hackread.com.
He also highlighted practical defenses, including monitoring device traffic. “Then alert when a device with no endpoint agent pulls a gigabyte-scale transfer from a peer device or an unapproved host or holds sustained traffic with another such device,” he said.
Ram Varadarajan, CEO at Acalvio, said defenders should not rely on the AI model itself to provide safeguards.
“Because open-weight models can be stripped of refusals or chosen without them, safety can’t live only in the weights or the serving layer. Cyber defenders need controls in the environment the AI model operates in, and model-aware deception is the method that exploits the agency that makes these replicators so dangerous,” Varadarajan told Hackread.com.
