Small AI Models Could Lower the Cost of IoT Worms, Anthropic Warns

The capability threshold is the real story

Anthropic’s Frontier Red Team reported that a 9 billion parameter model was able to run inference on eight of nine hardware types tested. The company also said GLM-5.2 completed a simplified replication task across eight Android emulators.

Those results matter because they challenge a familiar assumption about artificial intelligence malware: that useful models require powerful servers, abundant memory or access to a commercial application programming interface. If a model can run locally on inexpensive or constrained hardware, an attacker could potentially make each compromised device part of both the attack network and the computing infrastructure supporting it.

But Anthropic’s own conclusion is notably narrower than the most alarming interpretation. The company said the current capability floor and the ceiling imposed by available hardware do not yet intersect. In practical terms, models that can perform the relevant tasks are still too demanding for many target devices, while devices with sufficient capacity may not yet be able to execute the complete attack sequence.

Anthropic also said its work did not demonstrate a full autonomous IoT worm. That distinction should shape how businesses and security teams interpret the research. The experiment indicates a direction of travel, not an operational threat that is already spreading through consumer appliances.

Why smaller models change the economics

The commercial significance lies in cost structure. A conventional AI-enabled attack that depends on a remote model provider must pay for inference, maintain network access and risk detection through service logs or account controls. A local model removes at least some of those dependencies.

A sufficiently compact model could, in principle, be carried by malware or retrieved from a public repository after a device is compromised. That would allow the device to perform more of the work itself. The strategic advantage is not simply intelligence. It is distribution. Every infected device could potentially provide storage, computation and another route to additional targets.

That model could also make attacks more resilient. A centrally managed campaign may be disrupted by taking down a server or blocking access to a provider. A distributed campaign has fewer obvious points of failure if infected devices can make decisions locally. For manufacturers, that raises the cost of treating security as a narrow device feature. The issue becomes whether the entire installed base can resist adaptive software that does not require constant command traffic.

The risk is especially relevant to the economics of the IoT market. Smart appliances, cameras and other connected products compete heavily on price, and manufacturers often operate with limited hardware margins. Adding more memory, stronger processors and longer software support can increase costs without creating an immediately visible consumer benefit. A future in which local models become part of offensive malware would make those tradeoffs harder to defend.

The critical case against calling it a worm

The strongest criticism is that Anthropic’s test may demonstrate feasibility in a controlled setting without showing that real-world devices can be compromised and coordinated at scale.

BIG CHANGE Editorial argued that the experiment showed distributed inference and a simplified emulator task, rather than a rogue worm operating in the wild. Its critique highlights an unauthenticated Android Debug Bridge setup, an external inference server and other differences between the test environment and a real attack.

Those details go directly to the capability threshold. A model completing a task on eight emulators is not the same as identifying vulnerable devices, bypassing authentication, moving through heterogeneous networks, installing itself reliably and continuing without human intervention. Each step adds engineering constraints that can matter more than the model’s raw reasoning ability.

The criticism also weakens any claim that the experiment proves local autonomy. If an external inference server supplied part of the intelligence, the test did not fully establish that a compromised device could carry out the entire process without outside infrastructure. That is a meaningful limitation for defenders assessing the immediacy of the threat.

Evidence from a separate proof of concept

At the same time, the concern is not based only on Anthropic’s experiment. Jonas Guan, Tom Blanchard and their co-authors described a separate proof of concept involving an AI worm that used a local open-weight model to adapt attacks and propagate across a contained 33-host network, including IoT devices.

The researchers’ work supports the broader argument that AI-driven worms could operate without vendor APIs. It does not eliminate the gap identified by Anthropic, nor does it establish that consumer IoT networks are facing an imminent autonomous outbreak. But it suggests that local, adaptable attack logic is being explored independently of model providers.

For investors and manufacturers, the strategic question is therefore not whether a self-replicating IoT worm exists today. It is whether device design assumptions will remain valid as models become smaller, cheaper and easier to deploy locally. Anthropic’s result says the thresholds have not yet converged. The separate proof of concept suggests that the direction is already commercially and technically relevant.

The advantage will go to companies that treat compute capacity, authentication and software update systems as part of their security moat. Once intelligence can reproduce inside the network, centralized takedowns and fixed software defenses may no longer be enough.