AI Worms in the Smart Home: Why Self-Replicating AI Models Are Turning IoT Devices into a New Attack Surface

When AI Models Themselves Become Malware: A Paradigm Shift in Cybersecurity

The idea of malware that evolves autonomously has until now been largely the stuff of science fiction. Yet a recent report from Anthropic, the developer of the AI assistant Claude, brings this scenario into alarmingly tangible reach. The company warns that so-called Small Weight-Based Replicators – lightweight AI models that embed themselves as a payload into other systems – could usher in a new class of computer worms in the foreseeable future. Particularly in their sights: the billions of networked everyday devices collectively known as the Internet of Things (IoT).

For companies that rely on networked infrastructure, smart production facilities, or automated building management systems, these are not abstract laboratory findings – they are a concrete reason to reassess their own security strategy.

What Anthropic's Experiment Revealed – and What It Didn't

Anthropic researchers conducted a controlled experiment to investigate whether small, quantized AI models can run on low-cost IoT hardware. The results were sobering and alarming in equal measure: the model Gemma4-26B-A4B required only 15 Android TV boxes with 4 GB of RAM each to perform what is known as inference – that is, loading the model weights and generating outputs. Another model, Qwen3.5-9B, was able to configure itself autonomously on eight out of nine different hardware types.

This is technically remarkable: whereas conventional malware must be written for a specific hardware or software environment, an AI-based replicator can dynamically adapt its configuration to the target system at hand. Anthropic describes the theoretical attack flow in four phases:

• Identify targets: The model scans the network for vulnerable devices.
• Gain code execution: Access to the device is obtained via known vulnerabilities.
• Establish inference: The model loads itself onto the compromised device and launches an inference server.
• Propagation: The process repeats itself on additional devices within the network.

None of the lightweight models tested can yet complete this entire cycle autonomously and reliably. Inference was also extremely slow – in the case of Gemma4-26B-A4B, the processing speed was just 0.39 tokens per second, meaning a full setup on a target device could take between 71 and 150 hours. Nevertheless, Anthropic estimates that 30-billion-parameter models already handle many of the individual steps reliably.

„Such an 'AI worm' could carry its model weights with it as it reproduces – effectively, the weights would become part of the malware payload." – Anthropic

The Critical Difference from Classic IoT Worms

Anyone who remembers the Mirai botnet attack of 2016, which temporarily crippled the internet through massive DDoS attacks via compromised IoT devices, can imagine the scale a AI-powered counterpart could reach. The key difference lies in adaptability: Classic worms like Mirai operate according to hard-coded rules. An AI replicator, by contrast, can learn from failures – every unsuccessful compromise attempt leaves a kind of note for subsequent instances, so the same ineffective steps are not repeated.

There is also a further structural problem: there is no central server that could be shut down to stop the spread. The model distributes itself across hundreds or thousands of devices without relying on any central infrastructure. Anthropic describes in this context a doubling time of several days – slow by human perception, but potentially unstoppable if no appropriate countermeasures take effect.

Assessment: How serious is the threat, really?

At this point, nuance is called for. AI researcher Xiaohan Fu, who commented on the report, points to an important caveat: the experiment demonstrates that small models can be capable of replicating themselves – but it does not show that they would do so of their own accord. The autonomous decision to self-replicate was not observed in the trials; rather, the significantly more powerful model GLM-5.2 orchestrated the process, while smaller models were executed on the target devices. Furthermore, the Android devices tested had an open Android Debug Bridge interface – a configuration error that should be avoided in real production environments.

Dr. Maik Bunzel, founder and managing director of mabucon.eu, contextualizes the finding from the perspective of enterprise automation: "What Anthropic describes here is, at its core, the same principle we employ in agent-based systems for legitimate business processes – autonomous decision-making, dynamic adaptation to environmental conditions, and iterative learning from failures. The fact that these very same properties can also be exploited for attack purposes is no coincidence, but rather a systemic characteristic of agentic AI."

What does this mean in concrete terms for businesses?

The insights from the Anthropic experiment can be translated into several practically relevant areas for action:

• IoT inventory and network segmentation: Many organizations do not have a precise picture of which connected devices are active within their infrastructure. A comprehensive inventory and consistent isolation of IoT segments from the core network are fundamental protective measures.
• Disabling unused interfaces: Development and debug interfaces such as Android Debug Bridge must under no circumstances be openly accessible in production environments. This seemingly trivial measure would have made Anthropic's experimental setup considerably more difficult.
• Monitoring for anomalous compute behavior: Running AI inference on a device generates measurable computational load. Anomaly detection at the resource level can serve as an early warning signal.
• Supply-chain awareness for IoT hardware: Off-brand devices with pre-installed, poorly maintained firmware are particularly vulnerable. Organizations should critically review their procurement policies for network devices.
• Securing your own AI agents: Anyone relying on agent-based automation should ensure that the agents deployed cannot produce uncontrolled side effects on external systems.

The boundary between AI productivity and AI risk is narrowing

It would be a mistake to dismiss Anthropic's warning as a purely academic exercise. The very same trajectory that makes small language models attractive for legitimate business automation – low resource requirements, the ability to run on inexpensive hardware, dynamic adaptability – also makes them potentially interesting for attackers. And the models are improving faster than many security professionals currently anticipate.

Dr. Maik Bunzel, founder and managing director of mabucon.eu, sees a dual responsibility for organizations in this: "Anyone deploying AI agents productively must simultaneously understand how similar mechanisms can be exploited. This is not paranoia – it is a strategic necessity. Security architecture and AI strategy must be conceived together today."

Outlook: The race between defense and attack

Anthropic itself estimates that reliable Small Weight-Based Replicators could potentially become feasible in the near future, if the development of small models continues at the pace observed in recent years. This leaves defenders a narrow window of opportunity. At the same time, research shows that the hurdles for a functional end-to-end attack remain considerable – insufficient autonomy in the decision to self-replicate, extremely slow inference, and dependence on insecurely configured devices.

The critical question is not whether this attack path will eventually become technically viable – given the current state of research, that is likely. The critical question is whether organizations and security professionals will respond in time before a research finding becomes a real-world attack tool. The windows for preventive action close a little further with every advance in model development.