Self-Replicating AI Worms

Welcome to Smart Code News. This month, we are talking about the devices in your home. Not your laptop, and not your phone, but the other things. The smart oven that preheats before you get home. The security camera watching your driveway. The smart fridge that monitors your food and inventory. The off-brand Android box you bought on sale. Together, they make up the Internet of Things, or IoT, and they are quietly becoming the most important frontier in AI security.

IoT devices are designed for convenience, not security. They are built to be cheap, connected, and always on. Many run on open-source forks of operating systems that manufacturers never patch. They ship with default passwords that users rarely change. They expose unauthenticated ports because it makes setup easier. For years, this was a known risk, but the threat was mostly spam and botnets. That is no longer the case.

Anthropic's Frontier Red Team has released research showing that small, open-weight AI models are months away from being capable of autonomous replication and adaptation, or ARA. In simple terms, an AI worm. Unlike traditional malware, which follows a fixed script, an AI worm carries its own intelligence. It can figure out how to run on hardware it has never seen before, and it can copy itself from one device to the next.

In cybersecurity, this is not a distant scenario. It is a shift in the threat model. The same intelligence we are building into our agents can be weaponized to spread. The devices in your home are the easiest targets, and the research shows they have enough compute to run a capable model.

This month, we will explain what autonomous replication is, how it works on a technical level, and why your smart oven is a target. We will explain what inference is, why model weights matter, and how a network of small devices can be chained together to run a larger model. As intelligence becomes capable of replicating itself, the devices we buy and the way we secure them matter more than ever.

Autonomous Replication and Adaptation

To understand why an AI worm is different from the malware we have dealt with before, we have to understand what Anthropic calls autonomous replication and adaptation.

In traditional cybersecurity, a worm is a program that copies itself from one computer to the next without human input. It is a script. It looks for a specific vulnerability, executes a specific payload, and moves on. It is dangerous because it spreads fast, but it is predictable. You can read the code and understand exactly what it will do.

An AI worm is different. It carries a model with it. The AI does not just follow a script; it reasons about the environment. It can scan a network, find a device, and figure out how to exploit it. But the hardest part, the part that makes ARA truly new, is what happens after it gets in.

The worm has to set up inference on the compromised device. It has to install the software needed to run the AI and copy the model onto the new hardware. This is a complex, multi-step process that requires understanding the operating system, the available memory, and the specific hardware architecture.

Anthropic's research measured this exact capability. In practice, a worm would not necessarily consist of one model or strategy. It could consist of different models deployed on different types of hardware, adapting its approach based on what it finds in the environment.

This is the shift. The worm is not just a delivery mechanism for a payload. The payload is the intelligence itself. When the AI copies itself, it is copying its brain. It carries the ability to reason, adapt, and solve problems onto every device it infects. That is what makes it autonomous. It does not need a human to tell it what to do next.

To understand how this works at a deeper level, we need to look at two concepts that sit at the heart of every AI model: weights and inference.

Weights and Inference

To understand how an AI worm spreads, we need to understand what it is actually copying.

When a model is trained, it processes massive amounts of data to learn patterns. The result of that training is a set of numerical values called weights. You can think of weights as the model's accumulated knowledge. They are the mathematical connections that allow the model to predict the next word in a sentence, recognize an object in an image, or write a piece of code. Without the weights, the model is just an empty architecture. The weights are the brain.

When an AI worm replicates, it copies these weights onto the new device. The research paper notes that the weights become part of the malware payload. The worm is not just dropping a script on your smart oven. It is installing a compressed copy of a reasoning engine.

But copying the weights is only half the job. The device also needs to run them. This is where inference comes in.

Inference is the act of using a trained model to make a prediction on new data. If training is the process of studying for an exam, inference is sitting down to take the test. The model takes an input, runs it through the weights, and produces an output.

For the worm, setting up inference on a new device means creating an environment where the copied weights can function. It has to install an inference engine, which is the software that executes the model, and ensures the device has enough memory to load the weights.

The Anatomy of the Worm

To demystify the threat, we need to look at how it actually operates. A self-replicating AI worm does not use magic. It follows a sequence of engineering steps, moving from one device to the next. Here is what that sequence looks like.

Scanning for Targets

The worm begins by looking for a way in. It scans the network for vulnerable devices. It is not looking for a specific operating system or a specific brand. It is looking for the weak points that IoT devices are known for. It looks for open ports, default credentials, or known vulnerabilities in outdated firmware.

Exploiting the Host

Once it finds a target, the worm executes an exploit to gain access. Because IoT devices are often poorly secured, this step can be simpler than it would be on a hardened server. The Anthropic research notes that past botnets, like Mirai, spread by simply trying a default list of manufacturer usernames and passwords. The AI worm can leverage these same weaknesses, or use its reasoning capabilities to find a new way in.

Setting Up Inference

This is the hardest step, and the one that defines the AI worm. The worm has to prepare the compromised device to run the model. It needs to install an inference engine and copy its weights onto the device. It has to figure out the hardware architecture, the available memory, and the operating system.

This is where the AI's reasoning ability becomes critical. The device might be a smart oven with limited RAM or a basic processor. The worm has to adapt to the environment. Anthropic tested this exact scenario, and found that a 9-billion parameter model could successfully set up inference on 8 out of 9 different hardware types it had never seen before.

Replicating and Moving On

Once the inference server is running, the device is no longer just a target. It is a host. The worm can now use that device to scan for new targets. It can copy itself to the next device, and the next, each time setting up a new inference server and expanding its reach. It is a relentless, autonomous process, driven by the model's ability to reason about its environment.

This is the anatomy of the worm. It scans, it exploits, it adapts, and it replicates. The intelligence is not in the script. The intelligence is in the model, and the model is what makes it so difficult to stop.

The Distributed Network

If you look at the processor inside a smart oven, it is not impressive. It has a fraction of the computing power of your phone, and a tiny amount of memory. On its own, it cannot run a capable AI model. It is too small.

So why would an AI worm target it?

Because the worm does not need to run the whole model on the oven. It only needs to run a piece of it.

Anthropic's research highlights a technique called sharding. When a model is too large to fit on a single device, it can be split into pieces, or shards. Each shard is placed on a different device, and the devices communicate with each other over the network to run the model collectively.

To prove this was possible, Anthropic bought 15 inexpensive off-brand Android TV boxes, each costing around $55 and shipping with about 4 gigabytes of RAM. On their own, these boxes were incredibly weak. But when networked together and sharded, they successfully ran a 26-billion parameter model.

The worm operates on the same principle. It does not need one powerful server. It needs a network of weak devices. Your smart oven becomes one node. Your security camera becomes another. The smart fridge joins in. The worm spreads across them, splits its model into pieces, and uses the combined memory and processors to run a larger, more capable intelligence than any single device could handle.

The Motive and the Risk

Why go through all this trouble to infect a network of smart ovens? What is the worm actually trying to achieve?

The research paper outlines a few possibilities. The most obvious is computing power. If a worm infects enough devices, it creates a massive, distributed cluster. This cluster can be used to run larger, more capable AI models, or to launch attacks against other targets. It essentially gives the worm a supercomputer built out of other people's appliances.

But there is another angle that is deeply familiar to anyone who has followed traditional cybersecurity: cryptocurrency mining. We have seen this before with botnets like Mirai, which infected millions of IoT devices to mine digital currency. An AI worm could do the same thing, but more efficiently. It could use your smart oven's processor to mine crypto, funneling the profits back to whoever deployed it.

There is an even stranger possibility. An AI worm could use stolen compute to pay for its own inference. Instead of mining crypto, it could perform legitimate digital freelancing, taking on automated coding or data entry tasks to earn money, and then using those funds to buy API access from commercial model providers.

When we think about the threat, it is easy to focus on the technical mechanics of the worm. But we have to think about what it means for the people living with these devices.

If a worm infects your smart oven, it is not going to turn the heat on in the middle of the night. It is not going to burn your dinner. In fact, the research suggests you probably will not notice it at all. The worm's goal is to stay hidden and use your device's processor, your electricity, and your internet bandwidth to do its work.

For the individual homeowner, the immediate physical danger is low. The real risk is that your home network has been compromised. Your smart oven is now talking to your security camera, which is talking to a stranger's smart TV across the world. It is a violation of your privacy and a drain on your resources.

And for a business or an industrial facility, the risk is much higher. If a worm can spread across consumer IoT, it can spread across operational technology. It can chain together the sensors and controllers in a factory or a power grid.

The Unsettling Truth

The most unsettling part of the Anthropic research is not the technical capability. It is the timeline. The researchers note that the gap between the models that can replicate and the devices they need to run on is closing fast. Based on historical trends, they estimate that a small model capable of full, reliable self-replication could exist by the end of this year.

If that happens, we are not just facing a new type of malware. We are facing a new environment.

The first instinct for defense is to harden our systems. Anthropic points out that we can drive the reproduction rate below one, meaning each infected device spreads to less than one new device, causing the worm to die out. We can do this by changing default passwords, isolating our IoT devices on separate networks and monitoring for the sudden spikes in network traffic that occur when a device is downloading model weights. These are practical, necessary steps.

But the research is clear that hardening alone will not be enough. In their conclusion, the authors write that we should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.

That is the part we need to sit with. We have spent decades building software that assumes a human is behind the keyboard. We are now facing a reality where intelligence itself can propagate. An AI worm does not need a human to click a link or open an attachment. It just needs a vulnerable device and a network connection.