This study emerges from critical research that explored whether compact language models could generate self-replicating threats targeting Internet of Things (IoT) ecosystems. While established worms like Mirai typically employ static payloads such as DDoS scripts, these autonomous AI threats have the potential to adapt exploits and payloads dynamically based on target vulnerabilities. Such persistent infection chains would significantly increase the difficulty of containment for network operators.
“An ‘AI worm’ paradigm suggests an adapter could transfer its model weights during reproduction—either via propagation or by downloading from a public reservoir—and subsequently execute inference operations on compromised hardware,” Anthropic explained. “Essentially, the model parameters would integrate directly into the malicious payload.”
These entities are categorized as ‘small weight‑based replicators.’ Equipped with agents that grant access to common exploitation utilities, including reverse shells, the attack lifecycle progresses through four stages: identifying targets, achieving code execution, establishing inference capabilities, and disseminating to new hosts. A significant distinction compared to traditional worms lies in the agents’ ability to continuously improve upon failure. Should an AI replicator fail to compromise a specific device, the system logs detailed examples of unsuccessful attempts and their lessons, allowing future iterations to bypass redundant, ineffective pathways without unnecessary trial.
Researchers identified dynamic inference configuration as the least researched yet most complex segment of the replication loop. Effective execution requires navigating extensive decision trees driven by distinct hardware and software environments, alongside the selection of compatible inference libraries, management of software dependencies, and resolution of platform-specific compatibility issues.
“These sequential steps are highly interdependent, and recovery from failure points proves exceptionally challenging,” noted the team.
The preliminary findings indicate that compact models are rapidly advancing in their capacity for autonomous problem‑solving. However, at present, none of the lightweight models evaluated have achieved a fully end‑to‑end replication cycle—covering discovery, exploitation, payload injection, inference server configuration, and iterative repetition. Moreover, performance lag is significant; for example, an unoptimized Gemma‑4 variant operating across fifteen Android TV boxes processed data at only 0.39 tokens per second, resulting in inference times spanning 71 to 150 hours. By contrast, Qwen‑3.5‑9B required approximately 29 to 51 hours. Interestingly, the larger GLM‑5.2 model demonstrated reliable and consistent success in replicating the entire process.
