Anthropic warns that small AI models could replicate themselves through their IoT devices

"Small weight-based replicators" could give rise to a new generation of computer worms.

"Weight-based micromultipliers" could spawn a new generation of computer worms.

Advances in small AI models could soon usher in a new era of self-replicating malware that can infect smart refrigerators, vacuum cleaners and a wide range of other IoT devices and is more resistant to removal, AI firm Anthropic warns.

By next year, smaller AI models may be able to automatically replicate on a variety of IoT devices, according to the company. Ultimately, this capability can enable computer worms that spread without requiring human interaction and can infect unfamiliar IoT devices. A test the company recently conducted revealed significant challenges in scoring such AI-like malware, so this finding must be tempered. However, the results raise concerns about the possibility of new forms of computer worms.

Anthropic further warned that not only is there potential new malware, but it can also be difficult to stop. In his blog post, he wrote that “a holiday like this will be challenging to shut down because there's no central point to shut down – although it can be slow (with doubling the time of day).

Smaller AI models require much less hardware to run than frontier models. Entropic has implemented lightweight open-source models on real, low-cost, unbranded Android TV boxes and other simulated IoT hardware. The company's researchers found that by using quantization to represent models using fewer bits and by dividing workloads into "shards" that run on each device, the models are able to infer, meaning that the weight of the model is loaded and can produce output.

The lightweight model Gemma4-26B-A4B required only 15 boxes, each equipped with only 4 GB of memory, to achieve inference. Qwen3.5-9B was able to configure other LLMs to run on eight of the nine hardware types. Unlike traditional malware, which must be written to run on specific hardware or software, the model could use its weights to create configurations that were specific to the devices it was tested on.

This finding was the starting point for further research that asked: Is it possible for small models to create self-replicating infections that run on IoT devices the way traditional IoT worms, such as Mirai, install DDoS code and other payloads? Unlike Mirai, these AI worms can pose a much higher threat because the models can dynamically adjust exploits and payloads depending on the target. Once such a chain of infection begins, it may also be more difficult for defenders to stop it.

Entropic called these autonomous worms weight-based micropropagators. The models implemented agents that accessed common exploitation tools, such as reverse shells. The flow of attacks was (1) finding targets, (2) obtaining code execution, (3) creating inferences, and (4) spreading to new hosts. A key advantage over traditional worms, Entropic says, is the agents' ability to learn on the job. Every time an AI replicator fails to compromise a particular platform device, it can leave a list of prompts, codes, and notes for future replicators to avoid wasting time reusing the same ineffective steps.

Dynamic inference tuning is the least studied and probably the most challenging step in the iteration cycle, Anthropic said. This requires a long sequence of decisions based on each target's specific hardware and software, including selecting compatible inference software, installing dependencies, and debugging platform-specific bugs.

"These steps are serially dependent, and failures are difficult to recover from," Antropik said.

This experiment shows that small models are increasingly capable of solving those problems independently. However, currently, none of the tested lightweight models are capable of installing end-to-end replication, i.e. discovering new devices, using an exploit to access them, infecting them with a payload, configuring the inference server, and repeating the process. The process is also painfully slow. Gemma4-26B-A4B, distributed across 15 Android TV boxes, runs at just 0.39 tokens per second. This translates to a full inference setup time of 71 to 150 hours for the unoptimized Gemma4-26B-A4B and 29 to 51 hours for Qwen3.5-9B. (The large GLM-5.2 model appears to be able to do this reliably, the researchers said.)

The company said that the 30B parameter models can complete many single replication steps now, although they fail when performing end-to-end replication. The company continued that if small models continue to develop at their current rate, they may achieve the same limited results by the end of the year, and "small weight-based multipliers may soon be possible."

This experiment leaves many important considerations unanswered. For the first time, Android devices targeted by mini-models had an uncertified Android debug bridge. This tool is used during development and debugging, but should never be used in production settings, as it gives attackers access to the entire device stack. And for another, this iteration was not done by the small models themselves, but with GLM-5.2 to coordinate the process while running the objectives of a smaller Llama model.

Finally, this experiment shows that small agent models are becoming capable of running complex and distributed inference infrastructures on multiple machines. What remains to be seen, however, is whether these models will begin to replicate themselves.

Artificial intelligence researcher Xiaohan Fu said: "Despite a well-designed experimental setup, this study alone does not show that small models can be replicated independently. Interview "Providing replicable agent setups, including prompts and detailed instructions given to the models, will help the research community better understand the findings and evaluate their implications. Such transparency is especially important to avoid conflating the demonstrated ability to "Proliferation is important with the emerging threat of auto-replication."

Dan Goodin is senior security editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In her spare time she enjoys gardening, cooking and following the independent music scene. Don is based in San Francisco. Follow him here on Mastodon and here on Bluesky. Contact him on the signal at DanArs.82.