Small AI models may be months away from replicating across commercial internet-connected devices, including inexpensive Android TV boxes and smart appliances, without relying on a data center. Such a worm could adapt to unfamiliar hardware and would lack a single central system that defenders could disable, although its spread could take days per doubling.
Tests distributed the 26-billion-parameter Gemma4-26B-A4B model across 15 off-brand Android TV boxes costing about $55 each.
A separate test measured whether a 9-billion-parameter model could configure inference for Llama 3. The process required selecting compatible software, installing dependencies and resolving hardware-specific problems.
The full replication sequence was tested in a firewalled network of eight Android 15 emulators. The devices exposed an unauthenticated Android Debug Bridge port, simplifying the initial access step. GLM-5. 2 was the only tested open-weight model to complete the sequence, reaching all eight nodes in four of five trials and seven in the remaining trial. The larger model orchestrated the process from a separate server while the target devices ran Llama 3.
The demonstration therefore did not show that a small model can independently compromise secured consumer devices, decide to replicate or run the entire process on its own hardware. Models with 30 billion parameters or fewer can perform many individual replication tasks but still make errors when combining them. Inference setup took roughly 29 to 51 hours for Qwen3. 5-9B and 71 to 150 hours for the distributed Gemma model.
A weight-based replicator could carry model parameters as part of its malware payload or download them from a public repository. It could also pass prompts, code and notes to later copies, allowing future instances to avoid failed approaches on particular hardware. Unlike conventional malware designed for a narrow device type, the model could adjust its software configuration as it encountered different systems.
The current capability threshold and the hardware capacity needed to run a reliable replicator do not yet overlap. If smaller models continue improving at their historical rate, they could reach the demonstrated capability level by the end of 2026, with smaller weight-based replicators possible afterward. That projection remains conditional on the gap between model capability and device limits closing.
A comparable IoT botnet infected more than two million devices, mainly Android TV boxes. If a fleet of that size were organized into groups of 15 running the tested 26-billion-parameter model, it could contain about 133,000 model copies and provide compute comparable to roughly 40 H100 GPUs, though each replication would remain slow. Large model transfers, device-to-device traffic that is unusual for the network and exposed debugging interfaces could provide detection or prevention opportunities.