The Threat of AI-Powered Worms
Anthropic's Frontier Red Team has demonstrated two components of a potential AI-powered worm that, if key issues with the practical implementation are resolved, could spread across consumer devices including inexpensive Android TV boxes and smart appliances, hypothetically without relying on datacenter infrastructure. The experiments show that AI agents can configure inference across different hardware platforms and orchestrate replication across a network. There are still some serious limitations, though, particularly around the gap between the capabilities of today's models versus the hardware constraints of potential targets.
In its October report, Anthropic examines a potential class of malware called a weight-based replicator. Rather than distributing conventional executable code, it would propagate AI model weights alongside the software infrastructure needed to run inference on compromised devices.
The researchers demonstrated that Qwen3.5-9B can establish an inference server on eight of nine tested hardware types, spanning NVIDIA Jetson Nano devices, Apple Silicon Macs, Xeon servers, a Google TPU, AMD's MI300X, and at least one PC with an RTX 4090, among others. They also ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing approximately $55 each, achieving a combined generation rate of 0.39 tokens per second.
Network Replication and Hardware Constraints
Anthropic also tested whether a model could orchestrate replication across a network. The experiment used eight Google Cloud nodes running Android 15 emulators. A seeded agent propagated between nodes through an unauthenticated Android Debug Bridge port, transferring files and establishing an inference server on each target. GLM-5.2, a large model with 744 billion parameters over 1TB in size, completed the replication sequence across all eight nodes in four of five trials, reaching seven nodes in the remaining trial.
No other tested open-weight model was able to complete the sequence at all without orchestration from GLM-5.2, and they weren't able to meaningfully ask a larger model for help, either, despite being equipped with the capability. GLM-5.2 established an inference server for the much smaller Llama 3.1 8B on each target because the emulated nodes couldn't handle the larger model.
Anthropic demonstrated that a very large, externally hosted model can orchestrate a simplified replication sequence across machines with deliberately exposed interfaces, and it showed that small models can set up inference, but it has not proven that a small model can independently replicate itself across consumer hardware.
Performance and Bandwidth Challenges
The experiments expose a central constraint of the research: models capable of reliably completing the replication sequence aren't currently small enough to run on inexpensive target devices, while models that fit within those devices' memory budgets still can't reliably complete the entire process. This gap means that this threat model isn't applicable right now, but Anthropic warns that the gap could narrow.
Using historical improvements in general AI capability measured through the Epoch Capabilities Index, Anthropic projects that a model within the 30-billion-parameter class could reach the necessary capability level by the end of 2026, though this still does not address efficiency problems.
Based on measured inference performance and token requirements, Anthropic estimates establishing an inference environment would take approximately 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B on cheap Android TV boxes configured with 4GB of RAM. A model-driven replicator could take days to establish an inference environment on a new host, whereas conventional malware can execute its payload within seconds.
Model weights also impose substantial bandwidth and storage costs. Distributing multi-gigabyte payloads and maintaining communication between machines running a sharded model would generate tremendous network traffic, making the activity easily detectable.
Anthropic estimates that a hypothetical fleet comparable in size to the Kimwolf botnet, which infected more than two million devices at its peak, could support approximately 133,000 instances of Gemma4-26B-A4B if every 15 devices collectively hosted one model, providing roughly 40 Hopper H100-equivalents of inference capacity.
Infecting two million devices would take around 6,300 agent-years even with the fastest stand-up speed to produce less AI inference throughput than a few blades of previous-generation GPUs.
Anthropic notes that a real replicator could exploit other types of hardware, deploy different models across heterogeneous devices, and avoid loading model weights onto every compromised host.
Conclusions on AI Security
The research identifies a meaningful security concern: AI agents could make malware more adaptable to unfamiliar environments and reduce the amount of target-specific engineering required. A hybrid approach combining conventional code for routine operations with AI-driven reasoning when unexpected conditions arise could offer some benefits without requiring every compromised device to run an inference engine continuously.
Anthropic's experiments provide evidence that autonomous software configuration and simplified network replication are increasingly feasible, but turning those capabilities into a materially more dangerous class of malware will require improvements in model reliability, hardware compatibility, and deployment efficiency.
