11:11Machine-translated from Azerbaijani by AIRead in Azerbaijani
Anthropic Warns of a Self-Replicating AI Worm
In research released on October 12, Anthropic highlighted a new threat that could emerge in the future. It involves an artificial intelligence (AI) worm that can replicate itself and spread across a network without needing a data center. Dubbed a “weight-based replicator,” this malware could copy files containing an AI model’s learned parameters, as well as the software needed to run the model, to devices instead of copying a conventional executable file. Low-cost Android TV devices and smart home appliances are among the main targets. Anthropic emphasizes that such a threat is not yet viable under real-world conditions.
During testing, Qwen3.5-9B was able to set up a server running an AI model on 8 of the 9 types of hardware tested. The list included NVIDIA Jetson Nano, Apple Silicon-based computers, and a Xeon server. Google TPU, AMD MI300X, and RTX 4090 were also tested successfully. The researchers also ran a 25-billion-parameter model on 15 low-cost Android TV devices. The number of parameters indicates the model’s size and complexity. Each device cost $55 (approximately 94 AZN). Together, the devices were able to generate only 0.39 tokens per second, meaning a very small segment of text. The network propagation test was conducted on 8 cloud nodes running an Android 15 emulator. The agent used an unsecured ADB connection, a channel for remotely connecting to an Android device, to copy files and set up a server on each device. The GLM-5.2 model, which is more than 1 TB in size, has 744 billion parameters. In 4 of the 5 tests, the model was able to spread to all 8 nodes; in the other test, it reached 7 nodes. Instead of deploying itself on the devices, the large model deployed the smaller Llama 3.1 8B model. The main challenge is the gap between the AI model’s capabilities and the power of low-cost devices. Large models capable of managing the propagation process cannot run on such underpowered devices. Small models cannot complete the process on their own either. Setting up the runtime environment for Qwen3.5-9B can take 28-51 hours. For the Gemma4-26B-A4B model, this rises to 71-150 hours. By comparison, conventional malware completes the same task in seconds and can spread to thousands of devices in a matter of minutes.
According to Anthropic’s calculations, a model in the 30-billion-parameter class could reach the necessary level of capability by the end of 2026. However, transferring very large files slows propagation and leaves an easily detectable trace on the network. A network of 2 million devices on the scale of Kimwolf could run approximately 133,000 instances of the Gemma4-26B-A4B model. Despite this, their combined computing power would be equivalent to just 40 Hopper H100 accelerators.
In the future, such an AI worm could divide the model into parts and run them jointly across infected IoT devices, meaning smart devices connected to the internet. Security cameras and videoconferencing equipment with dedicated chips for AI operations are among the potential targets. More powerful variants could attack data centers and use the equipment there to spread. An API-based version could use stolen accounts to connect to commercial AI services. It could sell services on digital work platforms to cover computing costs. During such an attack, sending many gigabytes of model files to devices could attract attention. Data flows between devices that do not normally communicate would also look suspicious. The initial defense measure is to disconnect devices believed to be infected from the network. Restricting network access to approved websites only and opening cleanup instructions in the browser could help remove the infection. Abandoning default passwords, enabling automatic updates, and providing software updates for devices over a longer period would strengthen protection against both conventional malware and AI worms.
During testing, Qwen3.5-9B was able to set up a server running an AI model on 8 of the 9 types of hardware tested. The list included NVIDIA Jetson Nano, Apple Silicon-based computers, and a Xeon server. Google TPU, AMD MI300X, and RTX 4090 were also tested successfully. The researchers also ran a 25-billion-parameter model on 15 low-cost Android TV devices. The number of parameters indicates the model’s size and complexity. Each device cost $55 (approximately 94 AZN). Together, the devices were able to generate only 0.39 tokens per second, meaning a very small segment of text. The network propagation test was conducted on 8 cloud nodes running an Android 15 emulator. The agent used an unsecured ADB connection, a channel for remotely connecting to an Android device, to copy files and set up a server on each device. The GLM-5.2 model, which is more than 1 TB in size, has 744 billion parameters. In 4 of the 5 tests, the model was able to spread to all 8 nodes; in the other test, it reached 7 nodes. Instead of deploying itself on the devices, the large model deployed the smaller Llama 3.1 8B model. The main challenge is the gap between the AI model’s capabilities and the power of low-cost devices. Large models capable of managing the propagation process cannot run on such underpowered devices. Small models cannot complete the process on their own either. Setting up the runtime environment for Qwen3.5-9B can take 28-51 hours. For the Gemma4-26B-A4B model, this rises to 71-150 hours. By comparison, conventional malware completes the same task in seconds and can spread to thousands of devices in a matter of minutes. According to Anthropic’s calculations, a model in the 30-billion-parameter class could reach the necessary level of capability by the end of 2026. However, transferring very large files slows propagation and leaves an easily detectable trace on the network. A network of 2 million devices on the scale of Kimwolf could run approximately 133,000 instances of the Gemma4-26B-A4B model. Despite this, their combined computing power would be equivalent to just 40 Hopper H100 accelerators. In the future, such an AI worm could divide the model into parts and run them jointly across infected IoT devices, meaning smart devices connected to the internet. Security cameras and videoconferencing equipment with dedicated chips for AI operations are among the potential targets. More powerful variants could attack data centers and use the equipment there to spread. An API-based version could use stolen accounts to connect to commercial AI services. It could sell services on digital work platforms to cover computing costs. During such an attack, sending many gigabytes of model files to devices could attract attention. Data flows between devices that do not normally communicate would also look suspicious. The initial defense measure is to disconnect devices believed to be infected from the network. Restricting network access to approved websites only and opening cleanup instructions in the browser could help remove the infection. Abandoning default passwords, enabling automatic updates, and providing software updates for devices over a longer period would strengthen protection against both conventional malware and AI worms.