Anthropic has published research on a concrete technical risk: small AI models deployed on cheap IoT hardware could self-replicate across networks without human intervention, creating a new class of adaptive malware.
The concern centers on a specific capability gap. Unlike traditional worms, which must be custom-written for each hardware configuration, AI models can adapt on the fly. A compromised device running a quantized language model could probe unfamiliar hardware, reconfigure itself to run on low-memory chips, and spawn copies across a network—each iteration learning from the target environment.
Anthropiconducted experiments using lightweight models like Gemma4-26B and Qwen3.5-9B on simulated IoT hardware. The Gemma4 model required only 15 Android TV boxes with 4GB memory each to achieve full inference. By splitting computational workloads into "shards" distributed across devices and using quantization to compress model weights, researchers showed that modern language models can run on the type of underpowered, unpatched hardware that dominates consumer IoT.
The business logic of the threat is straightforward. IoT devices—smart TVs, refrigerators, network cameras—run outdated software with known vulnerabilities. They are numerous, globally distributed, and largely unmonitored. A traditional worm like Mirai exploited this surface by installing DDoS code. An AI worm would carry model weights as its payload, downloading them from a public repository or storing them locally. Once installed, it could generate device-specific exploits, adapt its behavior to evade detection, and propagate faster as the infection spreads.
Anthropics research identified significant technical hurdles in building such a system. Inference on 4GB devices remains computationally expensive, and model quantization degrades performance. But the company emphasized that these barriers are not permanent. As models compress further and exploit frameworks mature, the doubling time—measured currently in days—could accelerate.
The decentralized nature of such an attack makes containment harder than traditional botnets. There is no command-and-control server to shut down, no single point of failure. Each infected device is autonomous.
Anthropics research does not claim such worms exist or are imminent. The work is a threat modeling exercise grounded in current model capabilities and publicly available tools. But it serves a critical function for the AI industry: identifying attack surfaces before they become active problems. The company has shared findings with relevant security bodies.
