Anthropic warns small AI models could replicate across IoT devices

Anthropic defines a cyber worm as a program that copies itself between computers without human input.[1] It says an AI worm could figure out unfamiliar devices on its own, unlike non-AI malware.[1] The study divides replication into four stages: finding targets, gaining execution, establishing inference and continuing propagation from a new host.[1] A worm could carry its model weights as it spreads or download them again from a public hub, then run inference on compromised hardware.[1] Anthropic says a distributed worm would have no central point to switch off, though its doubling time could be days.[1]

Anthropic reports that a 9-billion-parameter model got inference running on eight of the nine hardware types tested.[1] In a separate result, the model distributed across 15 boxes ran at 0.39 tokens per second, according to Anthropic.[1] Anthropic says models of 30 billion parameters or fewer can already complete many individual replication steps, but make mistakes when combining them end to end.[1] It says GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations.[1] SecurityWeek reports that GLM-5.2 was the only open-weight model tested to complete the full cycle, reaching all eight emulated devices in four of five runs.[2]

Anthropic says it largely set aside the cyber-exploit element, which covers the first two stages of replication: finding targets and gaining execution.[1] SecurityWeek reports that Anthropic regarded the full-cycle test results as an upper bound for success in real-world conditions.[2] TechXplore reports that Chandrasekaran said the work had not been independently verified.[4] Those qualifications matter when interpreting successful tests: the results describe what happened in the study’s evaluations, not a demonstrated infection of commercial devices.[1][2]

Anthropic says small models could reach GLM-5.2’s capability level by the end of 2026 if they keep improving at their historical rate.[1] SecurityWeek reports that small weight-based replicators may become possible soon after small models reach that level.[2] In a scenario based on a botnet as large as Kimwolf, which infected more than two million devices, SecurityWeek says roughly 133,000 model copies could run with combined compute worth at most about 40 Nvidia H100 GPUs.[2] Each replication in that scenario would take more than a day.[2] Anthropic recommends hardening systems to make spread harder and preparing for the possibility that replicators persist.[5]