A compromised smart TV or other connected device could, in theory, help an AI model spread to more hardware. Anthropic researchers tested parts of that scenario, focusing on whether a model could install a working AI environment on a device it had not encountered before. Their results point to a risk that is not yet fully realized, but may become more practical as small models improve.
Testing the path from one device to another
The researchers describe an AI worm as malware carrying model weights that can run directly on compromised hardware. Unlike conventional malware, such a system could use a model to inspect unfamiliar devices and adjust its setup so it can run there.
They broke the process into four stages: finding vulnerable devices on a network, gaining access, preparing an AI environment on a newly reached device, and spreading onward. The study did not test the actual hacking step. Earlier studies had already shown that small models could handle those attacks, so this work concentrated on the challenge of adapting to new hardware.
To explore whether consumer equipment could support model inference, the researchers distributed Gemma4-26B-A4B across 15 off-the-shelf Android TV boxes. Each box cost about $55 and had 4 gigabytes of RAM. The devices each handled part of the model’s layers. It ran slowly, but the setup worked.
One model completed the full sequence
Several models could manage individual parts of the process. A 9-billion-parameter model set up an AI environment running Llama3.1-8B on 8 out of 9 tested device types. Completing every stage in sequence, from a network scan to a working copy on another device, proved more difficult.
GLM-5.2 was the only model reported to complete the entire replication chain reliably. It infected all eight test nodes in four out of five runs. That result shows what the tested model could do in this experiment; it does not mean that an autonomous replicator is already operating across consumer devices.
The researchers also explored whether model instances could pass along lessons from earlier attempts. In this setup, each instance shared notes about strategies that had worked or failed with its successors. For Qwen3.5-9B, the success rate rose from 45 percent in the first generation to as high as 84 percent in later ones.
Capability and device limits still matter
A model would need to meet two conditions to become a practical autonomous replicator: it must be capable enough to carry out the steps, and small enough to run on consumer devices. The researchers say no current model meets both requirements.
They estimate that setting up on a new device could take between 28 and 150 hours, depending on the model. Such a process would be slow, but the study raises a separate concern: a decentralized network may be difficult to stop once it has spread across different types of hardware.
The researchers compare this kind of system to a “digital slime mold.” Their point is that a network spread across many devices might not depend on one central controller that could be switched off. They contrast that with traditional botnets such as Kimwolf, which at its peak infected more than two million devices, mostly Android TV boxes, but worked on specific device types.
In a botnet the size of Kimwolf, the researchers estimate the total compute would equal about 40 specialized AI chips. That comparison describes computing capacity, while the broader concern is that an AI botnet could operate across varied hardware without a central kill switch.
Defense would depend on coordination
The article describes several possible defenses. Internet service providers could quarantine infected networks. In the Mirai botnet case, 92 percent of infections were cleaned up within 14 days. Manufacturers could also reduce the number of vulnerable devices by banning default passwords, as the UK has already done by law.
Those measures may not end the risk. The researchers expect that AI botnets could adapt to defensive steps on their own. That makes device security and coordinated response relevant alongside improvements in model capability.
Anthropic CEO Dario Amodei has warned that a persistent botnet could cause damages in the hundreds of billions of dollars. He said such a swarm “could within 6 to 12 months be capable of taking over the entire internet with a persistent botnet, potentially causing hundreds of billions of dollars in damage.” The researchers, meanwhile, describe that as a prediction beyond their experiments.
The study’s findings are narrower than that forecast: a model completed a replication sequence in a controlled test, while no current model is both small enough and capable enough to carry out the scenario in the wild. The researchers say the gap could close by the end of 2026 if small models keep improving at their current pace. They see slow replicators as an early signal of the possibility of faster variants.