Anthropic's security researchers say small AI models may be months away from being able to spread on their own across cheap, poorly defended gadgets such as off-brand Android TV boxes and smart ovens. In a report published on Monday, Oct. 12, they describe something like a computer worm, a program that copies itself from one computer to the next without human input, except that this one would carry an AI model with it and run the model on the devices it takes over. Unlike ordinary malicious software, Anthropic says, it could work out unfamiliar devices on its own, and it would be hard to shut down, since there would be no central point to switch off.
To show that weak devices can run a capable AI model, the researchers bought 15 off-brand Android TV boxes for about $55 each, linked them together, and split an AI model called Gemma 4 across them, with each box holding a small slice of it. It worked, if slowly. They then tested whether small models could get an AI model running on hardware they had never seen. One small model managed it on 8 of the 9 kinds of hardware tested, which ranged from small computer boards to Mac computers and powerful graphics cards.
The next test put the whole cycle together: find a new device, copy itself over, start running there and repeat. The researchers built a sealed-off network of eight simulated Android devices, each with a connection left open and no password. Of the downloadable models they tested, only one, called GLM-5.2, completed the cycle, reaching all eight devices in four of five trials and seven in the fifth; the others consistently failed. On each new device, GLM-5.2 had to get a smaller model, Llama 3.1, running, while GLM-5.2 itself ran on a separate computer because the test machines were too small to hold it. So the test shows that a bigger model has the skill, not that a model small enough to live on such devices has it yet. Anthropic says small models can already do many of the separate steps but make mistakes when they string them together.
Anthropic says the test made spreading easier than it would be in the real world. It largely left out the hacking needed to break into a device, which the researchers say earlier studies show small models can already do when given the right tools, and the open connection made getting in trivial. They note, though, that Mirai, a past network of hijacked devices, spread simply by trying makers' default usernames and passwords, so real devices may not be much harder to get into. Using a general measure of AI skill, not a test of spreading itself, they estimate that models small enough to run on such devices will reach GLM-5.2's level by the end of this year if they keep improving at their past pace, and they call that only a rough estimate.
Poorly secured devices are already hijacked in large numbers. Cloudflare, an internet security company, says the Kimwolf botnet, a network of hijacked devices, has taken over about 2 million Android devices, including TV streaming boxes and phones, and gets in through the same kind of open debugging connection that Anthropic's test left unlocked. Anthropic estimates that a fleet of TV boxes that size could run about 133,000 copies of the model from its demo, but says the spread would be slow, with the number of copies taking days to double. The researchers compare such a program to a slime mold or a swarm of fruit flies, which multiply over days.
The researchers say defenders have some advantages. A worm moving multi-gigabyte AI files between devices would leave unusual traffic that internet providers can spot, and when one internet provider limited infected Mirai customers to a short list of websites and pointed them to cleanup instructions, 92% of infections were gone within 14 days, compared with 74% when customers weren't told. They also urge device makers to ship safer settings; Britain already bars smart devices sold with default passwords. Anthropic says it does not yet have a complete AI worm of this kind and that it has not tested how such a worm would respond to people trying to stop it. It is also not clear when small models will be able to spread this way.