Anthropic's Frontier Red Team has published tests and analysis warning about a possible future class of malware that uses AI models to embed, reproduce and evolve on infected devices without continuous reliance on a central data center. Their report outlines a so‑called "weight‑based replicator": rather than distributing traditional executable code, the threat would use AI model weights and inference to perform infection and adaptation tasks on the target device.
What hardware and models were tested, and what were the results?
In their experiments, Anthropic engineers tested multiple models on a variety of hardware. The Alibaba Qwen3.5‑9B model was able to create an inference server on eight of nine tested devices — in other words, it could run on those targets in a manner sufficient for the AI‑driven payload to operate. The successful devices included NVIDIA Jetson Nano units, Apple Silicon Macs, Xeon servers, Google TPUs, AMD MI300X systems, and at least one PC equipped with an RTX 4090.
They also ran Google's Gemma4‑26B‑A4B on a fleet of inexpensive Android TV boxes: 15 units costing roughly $55 each (about 18,000 forints) were able to run the AI‑based components.
Network replication test
Anthropic tested whether such models could replicate across a network without constant coordination from a large external server. Using eight Google Cloud nodes running Android 15 emulators, they observed that models were able to infect other devices connected to the same network without significant difficulty. From this the researchers conclude that a future malware of this type might not need continuous data‑center support to spread and partially evolve — some of that capability could be executed on the infected device itself.
Current limitations and security implications
The experiments also revealed important limitations. Models that are large enough to reliably carry out a full replication process are today too big to run on low‑cost or resource‑constrained target hardware. Smaller models that do fit on such devices have not yet demonstrated the reliable ability to complete the entire replication sequence. The researchers did not show that the small models could autonomously replicate themselves; if and when that becomes possible, the security implications would be significant.
Anthropic emphasizes that while the threat is not fully realized at present, the gap between the intelligence needed for reliable replication and the maximum model size supported by common target hardware may close as models and hardware improve.
Hybrid malware as a particular concern
The team calls out "hybrid" viruses as a likely future problem: in these designs, conventional prewritten code would handle predictable tasks while embedded AI models would respond to unanticipated situations. Such a hybrid approach could complicate detection, containment, and analysis.
Educational demonstration: Morris II
The report also notes that four security researchers developed an educational demonstration virus named Morris II to highlight risks and encourage AI platform providers to design defenses against these kinds of threats.
Conclusion
Anthropic's tests show that AI‑driven, weight‑based replication is technically plausible on a variety of hardware and can operate over networks in lab settings, but key technical barriers remain before fully autonomous replication on inexpensive devices becomes a practical threat. Nonetheless, the researchers warn that continued advances in model efficiency and device capability could make this class of threat relevant in the near future, and they urge defenders and platform developers to take the possibility into account when designing systems.
