Anthropic’s IoT worm tests point to device-security gaps

Anthropic’s research points towards AI-powered malware that could adapt to connected devices, but it does not demonstrate a small model independently completing a cycle of infection and replication. For businesses, the immediate finding is less exotic: inexpensive hardware can support distributed AI inference, while an exposed debugging interface can provide a remarkably convenient entrance.

What happened

According to Ars Technica – AI, Anthropic tested small open-weight models on real or simulated low-cost Android TV boxes and other Internet of Things hardware. The company’s concern is that improving models could eventually become computer worms that spread without human intervention, adapt to unfamiliar devices and prove difficult to shut down.

The researchers established that modest devices could collectively run models. They used quantisation, which represents model data with fewer bits, and divided workloads into shards distributed across machines. This achieved inference: the model weights could be loaded and used to generate output. It was a demonstration of computing capacity, not by itself an infection.

Gemma4-26B-A4B required 15 boxes, each with 4GB of memory, to achieve inference. Separately, Qwen3.5-9B configured other language models to run on eight of nine hardware types. That second result suggests an ability to adjust software configurations to different targets; it should not be mistaken for successfully breaking into eight kinds of device.

Performance was a substantial constraint. Gemma4-26B-A4B generated just 0.39 tokens per second across the 15 boxes. Full inference setup took an estimated 71–150 hours for the unoptimised Gemma model and 29–51 hours for Qwen3.5-9B. Hardware cheap enough to be overlooked was capable of useful computation, but hardly brisk computation.

Most importantly, none of the lightweight models tested completed end-to-end replication. They did not independently discover devices, exploit them, install a payload, configure inference and repeat the process. Ars also reports that the replication experiment used the larger GLM-5.2 model to orchestrate proceedings while target devices ran a smaller Llama model. The distinction between running on a device and organising an infection is central to the result.

The background

Ordinary computer worms already propagate without requiring a person to approve each infection. The proposed novelty is therefore not automatic spreading. It is putting model weights inside the malware’s working machinery, allowing an agent to reason about an unfamiliar target rather than rely solely on prewritten instructions for particular hardware and software.

Anthropic envisages weights travelling with the infection or being downloaded again from a public repository. Inference would then run on compromised hardware. Compared with a worm such as Mirai, which installs attack code and other payloads on connected devices, the proposed system could potentially adapt its exploits and payloads to the target it encounters.

The agents in the research had access to common exploitation tools, including reverse shells. Their intended sequence comprised target discovery, obtaining code execution, establishing inference and propagation. Anthropic also describes a way for failed attempts to leave prompts, code and notes for later agents, potentially sparing successors from repeating unsuccessful approaches. That is a proposed efficiency gain, not evidence that every failed attack teaches a useful lesson.

The difficult part is making inference work after access has been obtained. An agent must choose compatible software, install dependencies and resolve platform-specific faults. These decisions depend on preceding steps succeeding. A model that performs individual tasks competently can still fail when required to complete the whole chain without recovery assistance.

The access conditions deserve equal attention. Android targets exposed an unauthenticated Android Debug Bridge, a development and debugging tool that gives attackers access across the device stack. Ars notes that it should not be exposed in production. This made the experimental entry point unusually accommodating; the results cannot establish an equivalent ability to penetrate properly restricted devices.

For a buyer of connected equipment, this is the familiar problem of privileged access before it is a novel problem of AI. Our coverage of business credentials exposed by an Ivanti flaw concerns a different technology, but illustrates why the route into a system deserves scrutiny alongside what an attacker might do afterwards.

What people are saying

Anthropic’s position is forward-looking. The company says models with around 30 billion parameters can already perform many individual replication tasks, although they make mistakes across the complete sequence. If smaller models continue improving at their current pace, it expects them to reach similar limited capabilities by the end of the year, with small weight-based replicators potentially following soon afterwards. Those are conditional forecasts, not measured completion dates.

The company also argues that a distributed infection could resist takedown because there would be no single central service to switch off. It acknowledges that propagation might be slow, with a doubling time measured in days. The trade-off is important: the hypothesised threat is persistence across dispersed hardware, not necessarily a rapidly spreading outbreak.

Ars qualifies that warning by highlighting the exposed debugging interface and the larger model’s orchestration role. It reports that GLM-5.2 appears capable of reliable end-to-end replication, according to the researchers. That does not establish the same capability in the lightweight models that would need to operate within the constrained hardware discussed in the warning.

Xiaohan Fu, an AI researcher interviewed by Ars, draws another distinction: an experimental ability to replicate does not establish that a model would independently choose to do so. Fu calls for reproducible agent setups, including the precise prompts and instructions, so other researchers can assess what the experiment actually demonstrates.

That objection is about experimental interpretation, not proof that malicious replication is impossible. A model need not spontaneously decide to spread if someone instructs it to. But the instructions and assistance supplied determine whether a test demonstrates autonomous execution, externally directed behaviour or something between them. As with the evidence gaps in AI benchmarks, the conditions of a result matter as much as its headline.

What happens next

The decisive technical milestone would be a lightweight model completing the entire replication sequence without a larger model organising it. Repeating that result across different hardware, with the prompts and intervention points disclosed, would make the evidence substantially more useful. Successful setup on a prepared target answers only part of the security question.

A separate test concerns access. Results obtained through an unauthenticated debugging interface do not show how well the proposed worm would handle devices without that opening. Evidence of adaptation after entry and evidence of obtaining entry should be reported separately; otherwise a configuration achievement can acquire the reputation of an exploitation breakthrough.

Speed remains an unresolved constraint rather than a permanent safeguard. The reported setup times concern particular models and an unoptimised configuration. They neither establish a practical fast-spreading worm today nor guarantee that later systems would remain equally slow. For security planning, the relevant measures are successful replication, elapsed time and the amount of external help required.

The immediate business decision is therefore about exposure, not purchasing protection against a demonstrated new class of outbreak. An exposed development interface warrants attention regardless of which software uses it. Anthropic’s results add a reason to examine what inexpensive connected devices could compute after compromise; they do not yet justify treating every such device as an autonomous AI replicator.