AI Worms Explained: The Cybersecurity Risks, Real-World Experiments, and Defenses Businesses Need to Know

6 minutes ago

12 min read

Artificial intelligence is changing cybersecurity in two directions at once. Defensive systems are becoming more capable of identifying suspicious activity, analyzing vulnerabilities, and responding to incidents, while AI agents are gaining the ability to perform increasingly complex technical tasks with limited human supervision. A particularly important development is the emergence of research into autonomous replication, where AI-powered software can potentially move between connected devices, establish its own computing environment, and continue operating without continuous human direction.

Research published by Anthropic's Frontier Red Team on October 12, 2026, examines whether relatively small AI models could eventually support self-replicating malware across ordinary internet-connected devices. The experiments suggest that several individual capabilities required for such a system already exist, while some stronger models can combine them in controlled environments.

The implications extend beyond conventional malware. An AI-enabled worm could potentially adapt its technical approach to unfamiliar hardware, use distributed computing resources, and preserve successful strategies across successive copies. However, the research does not establish that a fully autonomous, unrestricted AI worm is already spreading through real-world networks.

The distinction between demonstrated capability and future risk is essential. The immediate priority for cybersecurity teams is to understand how these systems might operate, identify the weaknesses that could enable them, and strengthen defenses before autonomous replication becomes more practical.

What Is a Self-Replicating AI Worm?

A computer worm is malicious software that propagates between systems without requiring a user to manually copy or install it on every target. Traditional worms typically rely on known vulnerabilities, weak credentials, exposed services, or predictable software behavior to gain access to additional machines.

An AI worm introduces a different capability: it can use an AI model to make decisions and carry out technical tasks that would otherwise require extensive predefined instructions.

Rather than depending entirely on a fixed sequence of commands, an AI-enabled system could potentially investigate an unfamiliar operating environment, identify compatible software, resolve installation problems, and adjust its approach when an initial attempt fails.

Self-replication in this context involves more than copying a program. The system must establish the conditions necessary for its continued operation on a new host, including the computing environment required to run its AI model.

Anthropic's research examines autonomous replication and adaptation, or ARA, through four broad stages:

Target discovery: Identifying accessible devices and determining whether they may support execution.
Initial access: Obtaining a foothold through a compromised service, exposed interface, or other security weakness.
Inference setup: Preparing the necessary software, model components, and runtime environment.
Continued propagation: Repeating the process on additional systems while potentially carrying forward knowledge from previous attempts.

These stages create a more demanding technical problem than simply copying a file across a network. A replication system must coordinate networking, software installation, hardware compatibility, memory constraints, and model execution.

The research focuses particularly on inference setup, the process of making an AI model operational on unfamiliar hardware. This stage is important because the availability of vulnerable devices does not automatically mean that an AI model can run effectively on them.

Why Low-Cost Internet of Things Devices Matter

Cybersecurity discussions often focus on data centers, enterprise servers, and powerful graphics processing units. These systems are attractive targets because they offer substantial computing resources, but they are also generally subject to more formal security controls than many consumer devices.

The Internet of Things presents a different environment. Smart televisions, cameras, appliances, conferencing equipment, and other connected products may have limited memory, outdated software, inconsistent security support, or administrative interfaces that are poorly protected.

Some devices receive infrequent firmware updates. Others depend on manufacturers that provide limited long-term maintenance. Consumers may also leave default credentials unchanged or expose services unintentionally.

These weaknesses can create opportunities for conventional malware as well as more adaptive AI-enabled threats.

Anthropic's researchers examined inexpensive Android TV boxes as an example. In their demonstration, they distributed the Gemma4-26B-A4B model across 15 off-brand smart TV boxes, each costing approximately $55. The devices were networked together and collectively ran inference at roughly 0.39 tokens per second.

The significance of this experiment is not raw speed. The resulting system was slow compared with modern data-center hardware, but it demonstrated that a relatively capable model could operate across a collection of inexpensive devices.

The broader principle is distributed inference. Instead of storing an entire model on one machine, the system divides its layers across multiple devices, each performing part of the computation and communicating with the others.

This arrangement could make otherwise insufficient devices useful as components of a larger computing system. It also introduces substantial operational constraints, including network latency, limited memory bandwidth, device failures, and the need to coordinate execution.

The demonstration therefore illustrates a possible technical foundation for distributed AI computation, not proof that a comparable malicious network has already been deployed at scale.

Inside the Experiments: Can Small AI Models Establish Inference?

One of the central questions in the research is whether relatively small open-weight AI models can prepare inference environments on hardware they have not encountered before.

This is a difficult task because devices differ in processor architecture, operating system, available memory, software dependencies, and supported acceleration methods.

An AI agent attempting to establish inference must select a compatible software stack, identify appropriate package versions, diagnose errors, and recover when earlier decisions prove incorrect. These steps are interdependent, so one unresolved problem can prevent the entire process from succeeding.

To study this challenge, the researchers evaluated models on heterogeneous hardware, including compact edge systems and conventional computers. They reported that a model in the 9-billion-parameter class successfully established inference on eight of nine tested hardware types.

The researchers also developed Memento, an experimental framework built on the open-source Pi coding agent. Memento periodically starts a fresh agent instance while preserving the workspace and a short record of previous attempts.

This approach addresses a familiar weakness of long-running AI agents: they can become trapped in an incorrect explanation for a problem and continue repeating ineffective actions. A new instance with a concise history can explore an alternative strategy without discarding all earlier work.

The technique is relevant beyond cybersecurity. Persistent software agents, automated infrastructure maintenance, and complex engineering workflows all face similar challenges when tasks require many dependent decisions.

However, successful inference setup is only one part of autonomous replication. A model must also coordinate the wider process reliably, and that is where the experiments reveal a more significant capability threshold.

From Individual Tasks to Autonomous Replication

An AI model may be able to perform several technical tasks independently without being able to combine them into a reliable end-to-end process.

For example, identifying a reachable service, transferring software, configuring an inference runtime, and checking whether it works are separate capabilities. An autonomous system must coordinate them in the correct sequence, recover from errors, and determine when a new host is ready to continue the process.

Anthropic evaluated this problem using a contained Google Cloud Platform environment with eight Android emulator nodes. The test network used an unauthenticated Android Debug Bridge interface, deliberately simplifying the initial-access component.

The experiment therefore concentrated on whether models could orchestrate the remaining steps, rather than demonstrating a sophisticated exploit against a properly secured production network.

Among the tested open-weight models, GLM-5.2 was the only one reported to complete the full replication sequence reliably under the simplified conditions. It reached eight of eight nodes in four out of five trials and seven of eight in the remaining trial.

The result indicates that end-to-end orchestration can be a meaningful barrier even when individual capabilities are available. It also demonstrates why the experiment should not be interpreted as evidence that the same model could reliably compromise arbitrary internet-connected devices.

The testing environment removed important real-world obstacles, including authentication. Actual networks introduce additional barriers, such as segmentation, access controls, endpoint monitoring, incompatible software, rate limits, and security monitoring.

Nevertheless, the experiment provides a useful way to measure progress. As smaller models improve at coordinating technical tasks, the computing resources required to run them may become available on more devices.

This creates a potential convergence between two trends: increasing agent capability and the continued deployment of inexpensive edge computing hardware.

The Replication Threshold: When Could Smaller Models Become Capable?

The research identifies a fundamental engineering tension.

An AI replicator must be capable enough to complete the replication process, but small enough to run on the devices it targets. A highly capable model that requires powerful accelerators may not fit on ordinary consumer hardware, while a lightweight model may lack the reliability needed to establish inference and coordinate propagation.

At the time of the study, the researchers found that these two requirements did not fully overlap for the tested class of small models.

They then examined historical improvements in open-weight model capabilities. Their analysis found a fitted increase of 13.7 points per year on the Epoch Capabilities Index, with an R² value of 0.95 for the reported trend line.

Using GLM-5.2 as a proxy for the capability level required for replication, the researchers estimated that a small model could reach a similar level by the end of 2026 if the observed trend continued.

This is a projection based on a capability benchmark, not a demonstrated date for the arrival of a real-world autonomous worm. The index measures broader model capabilities rather than directly measuring successful malicious propagation in uncontrolled environments.

Actual feasibility also depends on factors that a general capability score cannot fully capture, including model architecture, inference efficiency, software reliability, hardware compatibility, and the security of the targeted network.

Even so, the projection highlights why security planning should not rely exclusively on current model size or current inference requirements. The relevant question is whether increasingly capable models can eventually operate within the constraints of widely deployed consumer hardware.

How Quickly Could an AI Worm Spread?

A potential AI worm built around low-cost devices would have a very different speed profile from malware operating on powerful servers.

In the reported experiments, running Gemma4-26B-A4B on the smart TV fleet was slow. Under the researchers' inference setup workload, a 32,000-token context window took approximately 27.3 to 31.8 hours to process. For Qwen3.5-9B, the equivalent window took around 10.9 hours.

Based on their measured workloads, the researchers estimated that a complete inference-setup trajectory could require approximately 71 to 150 hours for the unoptimized Gemma model and 28 to 51 hours for Qwen3.5-9B.

These figures are experimental estimates for the tested hardware and workload. They should not be treated as universal propagation times, since real-world conditions, model selection, task complexity, and available resources would differ.

The researchers also considered the potential scale of a network comparable in size to the Kimwolf IoT botnet, which was reported to have infected more than two million devices, primarily off-brand Android televisions.

In a hypothetical fleet of that size, groups of 15 televisions could support approximately 133,000 distributed copies of the demonstrated model configuration. The researchers estimated aggregate throughput of roughly 80,000 tokens per second under their stated assumptions.

For comparison, they cited an H100 serving Gemma4-26B-A4B at approximately 1,950 tokens per second under high concurrency with speculative decoding. By that reference, the hypothetical swarm would provide no more than about 40 H100-equivalents of inference.

This comparison puts the threat in perspective. The computing capacity would be modest relative to major data centers, and the replication process could take days. The concern is not that inexpensive televisions would suddenly become a supercomputer capable of matching a large AI cluster.

It is that a distributed network of compromised devices could remain operational across many locations, potentially making complete remediation more difficult than removing malware from a single centralized server.

Adaptation Could Make AI Worms Harder to Predict

Traditional malware often relies on known vulnerabilities, predetermined commands, and device-specific assumptions. Security teams can use those characteristics to develop detection signatures and response procedures.

An AI-enabled replicator could potentially introduce greater flexibility by modifying its approach in response to new environments.

Anthropic investigated a form of adaptation in which successive Qwen3.5-9B agent instances inherited notes about earlier attempts. The researchers reported that inference-setup success increased from 45% in the first generation to between 61% and 84% in later generations.

This result illustrates how experience can improve task completion without necessarily changing the underlying model weights. A successor instance can inherit useful troubleshooting information, successful strategies, and knowledge of previous failures.

The process resembles cumulative learning at the system level. Each instance benefits from information gathered by its predecessors, allowing a sequence of agents to improve their approach over time.

The researchers also tested whether a smaller model benefited from access to a stronger advisor, including Opus 4.8. In those experiments, advisor access did not produce a measurable improvement in inference setup. The smaller model often struggled to identify the right questions or make effective use of unsolicited guidance.

These findings suggest that reliable coordination remains a separate challenge. A future system might use a stronger model for planning and smaller models for specialized tasks, but that possibility is not the same as demonstrating that such a system can successfully coordinate a large-scale malicious network.

The wider security implication is that defenders may need to assess not only a malware sample's current behavior, but also its ability to change that behavior through inherited instructions, updated code, or different model components.

How AI Worms Differ From Traditional Botnets

Traditional botnets can already infect large numbers of poorly secured devices. The Mirai botnet, for example, demonstrated how weak credentials and exposed services could be used to compromise internet-connected equipment at scale.

AI-enabled botnets would not eliminate the weaknesses that make traditional botnets effective. Instead, they could potentially expand the range of environments in which a single system can operate.

Characteristic	Traditional botnet	Potential AI-enabled worm
Device compatibility	Often depends on predefined targets and known environments	May adapt software setup to unfamiliar environments
Error recovery	Usually follows programmed routines	May attempt context-sensitive troubleshooting
Learning between infections	Typically requires external updates or explicit programming	May inherit notes, code changes, and strategies from earlier instances
Resource requirements	Depends on the malware's design and purpose	May distribute model computation across multiple devices
Propagation speed	Can be rapid when vulnerabilities and exploits are readily available	May be slow when model inference and setup are resource-intensive
Defensive challenge	Signatures, vulnerability management, and network controls	The same defenses, supplemented by behavioral analysis and attention to adaptive execution

These differences are potential capabilities rather than universal properties. AI models can fail, behave inconsistently, and depend on fixed tools or scripts. Conventional malware can also be highly adaptive when designed with sophisticated logic.

The most plausible future threat may therefore involve a mixture of approaches: conventional scripts for predictable tasks, AI agents for unfamiliar environments, and larger models for planning where sufficient resources are available.

Defending Against Autonomous AI Replication

Effective defense begins with reducing the number of devices that an infected system can compromise. In epidemiological terms, the goal is to drive the reproduction number, R₀, below one, so that each infected device leads to fewer than one additional infection on average.

This requires layered security rather than dependence on a single detection technology.

Strengthen IoT security by default

Manufacturers should eliminate default shared passwords, provide secure configuration options, maintain firmware updates, and limit unnecessary network services. Devices that cannot receive security updates need a clearly defined support lifecycle and practical isolation options.

Organizations and consumers should change default credentials, disable unused services, and keep routers, cameras, smart televisions, and other connected devices updated.

Monitor unusual network behavior

A distributed inference system may generate traffic patterns that differ from ordinary device activity. Examples include unexpected large transfers, persistent communication between devices that would not normally exchange substantial data, and repeated scanning of network services.

These signals are not proof of an AI worm, but they can help identify suspicious behavior. Internet service providers and enterprise network operators may be able to detect anomalies that are difficult to observe from an individual endpoint.

Isolate and quarantine compromised systems

Network segmentation can limit an infection's ability to reach additional devices. Infected systems should be isolated while security teams investigate the entry point, determine whether credentials were exposed, and assess whether other hosts were affected.

The research points to previous botnet remediation efforts in which quarantining infected subscribers and notifying customers substantially improved cleanup outcomes. Similar principles could help contain future AI-enabled threats, although the effectiveness would depend on the infection mechanism and available remediation methods.

Use honeypots and coordinated incident response

Decoy devices and controlled environments can help researchers capture suspicious software and study its behavior. This can support the development of detection rules, indicators of compromise, and recovery procedures.

Because distributed botnets may span multiple internet service providers, manufacturers, and jurisdictions, effective response also requires coordination between network operators, device vendors, security researchers, and public authorities.

Assess AI systems as part of the threat model

Organizations should consider how AI agents with access to code execution, network tools, credentials, and cloud resources could be misused. Appropriate controls include least-privilege access, monitoring of tool calls, restricted network egress, credential isolation, and clear approval boundaries for consequential actions.

Security testing should evaluate not only whether an agent can complete an isolated task, but also whether it can chain actions together in unintended ways.

The Business and Policy Implications

The emergence of autonomous replication research has implications for device manufacturers, cloud providers, telecommunications companies, enterprises, and governments.

Manufacturers face pressure to treat security as a continuing responsibility rather than a feature that ends at product shipment. Longer support periods, reliable update mechanisms, and secure defaults can reduce the number of devices available to attackers.

Cloud and network providers must consider how compromised systems could use legitimate infrastructure for model downloads, command communication, or other activities. Their monitoring systems need to distinguish malicious behavior from legitimate software updates and distributed computing workloads.

Enterprises should reassess connected devices that operate outside conventional endpoint-security coverage. Conference equipment, cameras, building systems, and other specialized hardware may require dedicated inventory, segmentation, and monitoring policies.

Policy measures can help coordinate minimum security expectations across the IoT market. Regulations that encourage secure defaults, responsible vulnerability disclosure, and transparent support lifecycles may reduce systemic exposure. However, compliance requirements must be practical for manufacturers and should not substitute for effective technical security.

Prepare for Adaptive Malware Without Exaggerating the Evidence

Research into self-replicating AI worms shows that autonomous replication is best understood as a chain of technical capabilities, not a single breakthrough. Models must coordinate access, software setup, inference, and propagation, while operating within hardware and network constraints.

Anthropic's experiments demonstrate that small models can establish inference across several hardware types, that a stronger model can complete a simplified replication sequence, and that inherited troubleshooting notes can improve performance over successive generations. The work also indicates that inference on low-cost devices can be slow, and that general capability benchmarks do not establish when a real-world threat will become viable.

The central cybersecurity challenge is preparing for systems that may become more adaptable without assuming that every experimental capability translates directly into an uncontrolled global attack.

Stronger IoT security, timely updates, network segmentation, behavioral monitoring, and coordinated incident response remain essential. These measures protect against existing botnets as well as potential AI-enabled variants.

As Dr. Shahid Masood and the expert team at 1950.ai examine developments in artificial intelligence, cybersecurity, and emerging technology, autonomous replication deserves close attention as a practical security research area. The priority is to translate experimental findings into measurable defensive improvements before increasingly capable AI agents encounter the millions of connected devices that remain difficult to secure.