AI Worms Could Self-Replicate Across IoT Devices Using Small Language Models

Small AI models are raising concerns about a new class of self-replicating malware: AI worms that could adapt their exploits and payloads to different Internet of Things (IoT) devices.

This discovery served as a starting point for further research into whether small models could create self-replicating infections that execute themselves on IoT devices, similar to how traditional IoT worms such as Mirai install DDoS code and other payloads.

Unlike Mirai, AI worms could pose a greater threat because the model can dynamically adjust the exploit and payload depending on the target. Once an infection chain begins, it could also be difficult for defenders to stop.

How AI worms differ from traditional IoT malware

“Such an ‘AI worm’ could perform inference directly on the compromised hardware, recreating model weights (or re-downloading them from a public hub),” Anthropic said. “Effectively, the weight will become part of the malware payload.”

Researchers called these autonomous worms small weight-based replicators. The model ran an agent with access to common exploitation tools, including a reverse shell.

The attack flow involved four stages:

1. Finding the target
2. Executing code
3. Establishing inference
4. Propagating to new hosts

Anthropic said the main advantage over traditional worms is that AI agents can learn on the job. When an AI replicator fails to compromise a particular platform or device, it can leave a list of prompts, code, and notes for future replicators. This could prevent them from repeating the same inefficient steps.

Dynamic AI inference is the biggest technical challenge

Anthropic said that setting up dynamic inference is the least studied and perhaps the most difficult step in the replication cycle. The process requires a long series of decisions based on each target’s hardware and software, including selecting compatible inference software, installing dependencies, and debugging platform-specific bugs.

“These steps are sequentially dependent and difficult to recover from when a failure occurs,” Anthropic said.

Small models are not yet capable of end-to-end replication

The experiment shows that small models are increasingly capable of solving these problems autonomously. However, none of the lightweight models tested were able to complete end-to-end replication.

That would require discovering a new device, using an exploit to access it, infecting it with a payload, configuring an inference server, and repeating the process on another host.

The process is also very slow. Gemma4-26B-A4B distributed across 15 Android TV boxes ran at just 0.39 tokens per second. This translated into a complete inference setup time of 71 to 150 hours for unoptimized Gemma4-26B-A4B and 29 to 51 hours for Qwen3.5-9B.

Researchers said the larger GLM-5.2 model appeared capable of completing the process reliably.