DEV Community

Anoymask
Anoymask

Posted on

Self-Replicating AI Experiment: Deploying to IoT Nodes via Unauthenticated ADB to Form Decentralized Inference

#security #threatintel

1. Overview

2. Executive Summary

Anthropic evaluated whether AI models can set up inference on unfamiliar hardware and carry out successive node deployments. In a firewalled fleet of simulated Android nodes with unauthenticated ADB, GLM-5.2 reached all eight nodes in four of five trials. This does not demonstrate an autonomous worm spreading across physical IoT devices.

3. Research Question and Evaluation Conditions

The research question is whether a sufficiently capable small model could operate without a datacenter by placing its weights on target devices, running inference there, and completing the steps from finding targets to continuing deployment from a new node. Anthropic calls a replicator that runs its model directly on compromised hardware a weight-based replicator. The study examines which parts of that proposed chain are feasible today and which remain beyond current models or devices.

Anthropic evaluated inference setup on different hardware, successive deployments in an isolated virtual network, and distributed inference on physical devices. The physical-device experiment tested available compute; it was separate from the node-deployment experiment. None of these results is an observation of a malicious attack in the wild.

4. Inference Setup on Different Hardware

The evaluated models were asked to set up a server for Llama3.1-8B on different types of hardware, including Jetson Nano and Mac systems. Qwen3.5-9B completed the setup on eight of nine hardware types. This measures the ability to prepare inference for a given device, not the ability to break into that device.

Anthropic used Memento for long-running attempts. After a set execution period, it starts a fresh agent instance that inherits the previous workspace and brief notes. In a separate note-inheritance evaluation, Qwen3.5-9B's inference-setup success rate was 45% in the first generation and 61–84% in later generations. Those percentages are not real-world worm propagation rates.

5. Main Experiment: Node Deployment in an Isolated VPC

Anthropic placed eight GCP nodes running redroid, an Android 15 emulator, in a firewalled VPC. The nodes exposed unauthenticated ADB, and the agent began on a seeded “patient zero” node. The evaluation combined target discovery, access through unauthenticated ADB and a reverse shell, transfer of model weights and the agent harness, and setup of a Llama3.1-8B inference server on a target. After that server passed correctness and anti-cheating checks, the evaluator spawned the next worm instance on the target node.

The model controlling propagation ran inference on a separate server. The server built on each redroid node served Llama3.1-8B. Thus, the experiment does not show GLM-5.2 running its own inference and fully replicating itself on each node.

Under these simplified conditions, GLM-5.2 reached all eight nodes in four of five trials and seven nodes in the remaining trial. Other evaluated models did not reliably complete the full sequence. Because the access step was simplified to unauthenticated ADB, these results cannot be used as an intrusion success rate against authenticated physical IoT devices or as evidence of infections in the wild.

6. Supplementary Experiment: Distributed Inference on Android TV Boxes

On 15 researcher-owned Android TV boxes with 4 GB of RAM each, Anthropic split the layers of Gemma4-26B-A4B across devices and ran inference using pipeline parallelism at approximately 0.39 tokens per second. This showed that a group of inexpensive devices could run the model without a datacenter. The physical-device demonstration did not include autonomous intrusion or node-to-node self-propagation.

7. Interpreting the Results and Their Limits

  • Smaller models can complete individual inference-setup tasks, but the capability needed to complete the simplified deployment chain does not yet coincide with the model size that the tested IoT devices can run. A fully autonomous worm on physical IoT hardware has not been demonstrated.
  • GLM-5.2's result indicates what might become possible if comparable capabilities fit into a smaller model. Different model architectures and inference implementations could change the outcome.
  • The article's estimates of when such models might emerge and how quickly they might spread are predictions or rough calculations, not measured propagation rates in real networks.

8. Defensive Application and Evidence to Retain

Disabling unauthenticated ADB and unnecessary debug services, and limiting communication between IoT devices, directly addresses the simplified access conditions used in the experiment. Large transfers of model weights to devices, sustained traffic between devices that do not normally communicate, and expanding outbound connections after scanning are candidates for investigation if similar behavior arises. These are proposed monitoring ideas, not indicators of a compromise observed by Anthropic in a production environment.

For an investigation, retain device and firmware inventories, ADB and debug settings, inter-device flow records and transfer volumes, and any available records of processes, model files, and inference services. Low-cost IoT devices may provide limited endpoint logs, making network-side records important. A single large transfer or resource spike is insufficient to identify an AI worm; assess access, payload transfer, inference setup, and onward deployment separately.

9. Facts / Inference / Hypothesis

Facts

  • Anthropic evaluated inference setup on unfamiliar hardware and successive node deployments under controlled, simplified cyber conditions.
  • Qwen3.5-9B completed Llama3.1-8B inference setup on eight of nine hardware types.
  • Eight redroid nodes in a firewalled VPC exposed unauthenticated ADB. The model controlling propagation ran on a separate inference server; the servers built on the redroid nodes served Llama3.1-8B.
  • GLM-5.2 reached all eight nodes in four of five trials and seven nodes in the remaining trial.
  • Memento starts a fresh agent instance after a set period and passes on the workspace and brief notes. In a separate inheritance evaluation, Qwen3.5-9B's inference-setup success rate was 45% in the first generation and 61–84% in later generations.
  • Gemma4-26B-A4B ran at approximately 0.39 tokens per second across 15 researcher-owned Android TV boxes with 4 GB of RAM each. That physical-device experiment did not test autonomous intrusion or self-propagation.

Inference

  • If defenders apply the controlled experiment's sequence to monitoring, large inter-device transfers followed by scanning and new connections may provide leads. They must still distinguish these from authorized management activity.
  • Assessing on-device compute separately from an agent's ability to deploy itself helps avoid overstating the current feasibility of a physical IoT worm.

Hypothesis

No additional hypotheses. Unverified questions are listed in “11. Unknowns and Further Research.”

10. MITRE ATT&CK Mapping

These mappings describe actions in the isolated experiment or a future threat model. They do not imply that an attack was observed in the wild.

ID Technique Confidence Basis
T1046 Network Service Discovery high The agent scanned the isolated network for nodes exposing unauthenticated ADB.
T1105 Ingress Tool Transfer high The experiment transferred model weights and the agent harness to another node.
T1496.001 Resource Hijacking: Compute Hijacking medium Using compromised-device compute for inference is part of the future threat model. No physical IoT compromise or unauthorized use of its resources was demonstrated.

11. Unknowns and Further Research

  • Whether a small model could complete the full sequence against authenticated, updated, heterogeneous physical IoT devices is unknown.
  • When a model that can run on those devices might acquire the capabilities needed for successive node deployment remains a prediction.
  • This study does not establish transfer volumes, propagation speed, or detectability in a real network.

12. Implications for Defenders

The study shows progress on individual inference-setup tasks and on a simplified deployment sequence, while leaving autonomous spread on physical devices unproven. Organizations that manage IoT devices can reduce exposure to this class of scenario by closing unnecessary ADB access and retaining visibility into unusual inter-device traffic. Treat the controlled trial counts as experimental results, not incident counts, and require separate evidence for intrusion and for inference running on a physical device.

13. Summaries by Audience

  • For SOCs: Correlate inter-device scanning, large transfers, and inference-service setup, while checking for legitimate device-management activity.
  • For Administrators: Close unnecessary ADB and debug services, restrict device-to-device traffic, and verify what logs are available.
  • For Users: Keep devices updated and turn off unneeded developer settings. This research did not report an attack against physical IoT devices.

Top comments (0)