Imagine a worm that doesn’t just execute a script embedded in it, but acts like a "living" engineer: it scans the network, finds new devices, independently selects drivers, compiles code to launch its own AI engine, and jumps on.
Imagine a worm that doesn’t just execute a script embedded in it, but acts like a "living" engineer: it scans the network, finds new devices, independently selects drivers, compiles code to launch its own AI engine, and jumps on.
Researchers from Frontier Red Team (William Zhou and Daniel Freeman) published a report that sounds like the plot of a cyberpunk thriller: in a few months, small artificial intelligences (up to 30 billion parameters) will be able to autonomously reproduce through ordinary IoT devices — from cheap Android TV boxes to smart ovens.
We have already written briefly about this this week. But on weekdays, everyone is usually busy. There is no time and resources to absorb long stories. On the weekend, let’s dive into this topic (believe me, it is important) and figure out together whether we should start being afraid :)
We (dev.ua) have gathered the main points from the research: how this "virus" works, why it is almost impossible to stop it, and when to expect the first real AI botnets.
The concept of ARA (Autonomous Replication and Adaptation) describes a scenario where an artificial intelligence model deploys and propagates itself without any human control.
Researchers have previously demonstrated that AI agents can find cyber exploits. However, the main challenge for a standalone worm is Inference Setup .
To start on someone else’s hardware, an AI worm must:
Determine the type of operating system and processor.
Choose a compatible library stack, fix version conflicts, and catch bugs.
Distribute your "weights" or run a lighter model on limited resources.
Continue scanning the network to find new victims.
This is what the Frontier Red Team tested.
To prove the viability of the concept, the researchers purchased 15 regular budget Android TV boxes (priced at around $55 each) with 4GB of RAM.
There are no powerful GPUs on such devices, but the researchers used pipeline parallelism: the Gemma4-26B-A4B model was broken into shards (fragments), and each prefix held only a few layers of the model.
Result: A fleet of 15 TV boxes produced an inference rate of 0.39 tokens per second. This is slow, but quite sufficient for an autonomous agent running in the background 24/7.
Autonomous replication scheme of the AI worm:
[Search for targets] ➔ [Get access] ➔ [Inference Setup] ➔ [Subsequent distribution]
Small models (up to 30B, such as the Qwen 3.5-9B) are able to boost the launch environment on 8 out of 9 tested hardware types (from Jetson Nano to RTX 4090). However, when trying to go through the entire cycle autonomously from "A" to "Z", they are still confused about the sequence of actions.
Flagship Open Models (GLM-5.2): In an isolated environment on GCP (8 redroid nodes), the GLM-5.2 model was able to autonomously infect the entire fleet in 4 out of 5 tests, successfully configuring the Llama 3.1-8B run on each device.
For a fully autonomous AI worm to emerge, two conditions must be met:
Capability Floor: The model must be intelligent enough to solve atypical engineering tasks during infection.
Size Ceiling: The model must be compact enough to fit into the memory of low-cost IoT devices.
These lines have not yet crossed. However, according to the Epoch Capabilities Index (ECI) model deployment schedule, the intelligence level of small models is increasing by 13.7 points per year.
Researchers predict that models with up to 30B parameters will reach the intelligence level of GLM-5.2 by the end of 2026. This means that small weight replicators will become a reality in the near future.
Lamarckian evolution (learning while propagating) tells us that, unlike regular code, an AI worm learns from its mistakes. In the experiment, the Qwen 3.5-9B model left “notes” for its subsequent copies. As a result, the percentage of successful inference deployment increased from 45% in the first generation to 61–84% in subsequent ones.
Adaptability to unknown hardware: A regular worm breaks if it hits an unfamiliar architecture. An AI agent can debug code, pick compiler flags, and find workarounds for errors.
No central shutdown point: This virus lives distributed across millions of household devices. Even if the command server is destroyed, the autonomous nodes will continue to search for new victims.
Interesting fact: the researchers tried giving small models access to a “senior advisor” (Opus 4.8). It turned out that this did not help: small models simply do not know how to ask complex AI the right questions, so they work most effectively as autonomous “workhorses.”
The speed of spread of such a worm will be low (doubling the network will take days, not minutes), which is more reminiscent of a "mold" or fruit fly population that gradually starts in fruit and then appears in large numbers (they can no longer be removed).
However, the scale of the Kimwolf botnet (recently infecting over 2 million set-top boxes) shows that the combined power of such networks could be the equivalent of dozens of H100 server GPUs. It could simply be a monster AI network that is self-propagating and uncontrolled.
The main takeaway for developers and cybersecurity professionals is that IoT device security can no longer be ignored. Basic default passwords and open ADB ports on smart TVs could become the foundation for an unmanaged digital organism in the coming years.
