Small AI models could be months away from self-replicating across fleets of cheap, poorly defended internet-of-things (IoT) devices such as smart ovens and off-brand Android TV boxes, according to new research. The finding points to a near-term shift in how cyber threats propagate, because an AI-driven worm would not need a datacenter to run and could figure out unfamiliar hardware on its own.
Published by a frontier AI lab’s red team, the study measured whether today’s small models can stand up inference on devices they have never seen, then chain the full replication cycle, scanning, infecting, and running, across a network of machines. The conclusion: in simplified tests, the strongest open-weight models already complete the full chain, and smaller models are improving fast enough to match that capability before the end of the year.
What is a weight-based AI replicator?
The research focuses on what it calls a weight-based replicator, a worm that carries an AI model’s weights as part of its payload and runs inference directly on the machines it infects. Unlike traditional malware that relies on fixed code, a weight-based replicator can reason about each new target and adapt its approach on the fly.
This kind of worm could spread in several ways. The most studied variant infects host machines directly. Other variants might steal API keys, hijack cloud accounts, or even pay for inference through legitimate freelance work. A realistic worst case would combine multiple strategies, with different models on different hardware working together as a swarm.
Why IoT devices make the threat concrete
Datacenter GPUs have long been the obvious target for AI malware, but they are not the only option. The research team bought and networked 15 inexpensive off-brand Android TV boxes, each priced around $55, and ran Gemma4-26B-A4B across them in a distributed setup. The sharded model, split under pipeline parallelism with each box holding two layers, produced 0.39 tokens per second.
Typical boxes in that price range ship with 1 to 4 GB of RAM. At 4-bit quantization, four machines with 4 GB each can run a 9B model, and ten or more machines can run a 26B model. Many home and small business devices, including smart fridges, smart ovens, robotic vacuum cleaners, and lawnmowers, are similarly light on memory but connected to the internet. A growing number of security cameras and video-conferencing units even ship with small built-in AI chips, making them attractive targets for this type of attack.
How close are current models to full self-replication?
The team broke autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Earlier work already showed that small models can handle the cyber-exploit steps, the scanning and breaching portion, so this study focused on the harder part: can a model stand up inference on unfamiliar hardware?
In evaluations across nine hardware types, a 9B model successfully got inference running on eight of them. The hardware ranged from Jetson Nanos to Mac PCs to RTX 4090s. More capable models, including GLM-5.2, were both more reliable and faster, achieving higher tokens per second and therefore faster replication.
For the full chain, the team built a firewalled virtual private cloud of eight Google Cloud Platform nodes running an Android 15 emulator. The worm hopped from node to node over an unauthenticated ADB port, delivered its payload, and stood up an inference server for Llama3.1-8B. Out of the open-weight models tested, only GLM-5.2 completed end-to-end replication reliably. In four of five trials it spread to all eight nodes; in the fifth it reached seven. The other models failed reliably.
How fast could such a worm spread?
The researchers estimate a doubling time measured in days, slow compared to traditional network worms but persistent. There is no centralized kill switch for a distributed botnet of IoT devices, and many of these devices re-infect easily after a restart. The team’s evaluation kept the cyber-exploit element trivial (no authentication on the ADB port), which they describe as an upper bound on real-world success. Past IoT botnets have spread by brute-forcing default manufacturer passwords, suggesting that real IoT security may not be dramatically harder than the test setup.
How AI worms differ from pre-AI malware
Two properties set this threat apart. First, an AI worm can adapt to unfamiliar devices without human-written exploit code; it reasons about what it finds. Second, its compute is stolen: the attacker’s marginal cost per new infection is effectively zero, because the worm runs on the victim’s hardware. Centralized safety controls like service refusals or rate limits do not apply, because the model is not being served by a commercial platform.
What defenses could help?
The study outlines several directions. Network-level defenses that detect anomalous behavior across fleets of similar devices can catch worms even when individual infections look normal. Requiring authenticated access on exposed ports, as opposed to the open ADB port in the test environment, would raise the bar. For device makers, shipping updates that close default-credential loopholes and limiting what unprivileged users can install would shrink the attack surface. For model developers, the researchers suggest continued investment in evaluations that measure replication capability directly, so that improvements in autonomy are matched by improvements in safety controls.
What the broader research shows
A separate 2023 study introduced the term autonomous replication and adaptation (ARA) and found that existing language-model agents could only complete the easiest replication tasks, though fine-tuning on unrelated objectives could produce more competent agents. A 2025 cybersecurity benchmark tested AI agents on 1,507 real-world vulnerabilities across 188 software projects; even the best combinations achieved only about a 20% success rate, but the benchmark also led to the discovery of 34 zero-day vulnerabilities. Together, these results suggest that self-sustaining AI-driven cyber threats are no longer theoretical.
FAQ
What is a weight-based AI replicator?
A weight-based replicator is a worm that carries an AI model’s weights as part of its payload and runs inference directly on the machines it infects, allowing it to adapt to each new target.
Can small AI models already self-replicate?
In simplified tests, GLM-5.2 and stronger open-weight models completed the full replication cycle. Models of 30B parameters and under can do many individual steps today but make mistakes when chaining them end to end.
Why are IoT devices a target for AI worms?
IoT devices are cheap, connected to the internet, and typically have minimal security. Distributed inference across many of them can run surprisingly capable models without needing datacenter GPUs.