AI learns to self-propagate, exposing critical vulnerabilities in budget IoT devices
AI has learned self-replication (image: RBC-Ukraine)
Small AI models could learn to spread independently among smart devices within just a few months. Experiments have shown that they are capable of autonomously launching on ordinary Android TV boxes and home appliances, according to research by Anthropic.
How does AI "hijack" cheap devices?
Unlike conventional viruses, an AI worm is capable of independently studying unfamiliar devices, adapting to a new operating system, and deploying necessary programs without human intervention.
The primary targets of such attacks are Internet of Things (IoT) devices, particularly inexpensive Android TV boxes, smart refrigerators, vacuum cleaners, and surveillance cameras. They are constantly connected to the network and have minimal basic protection.
During the experiment, researchers connected 15 inexpensive TV boxes with 4 gigabytes of RAM into a single network. A model with 26 billion parameters was able to successfully launch and operate on this equipment.
Stages of autonomous propagation and virus evolution
The self-replication process of an AI worm consists of four main steps:
- Searching for unprotected targets in the network;
- Gaining access to the device;
- Deploying and configuring the environment for artificial intelligence;
- Further scanning the network for the next jump.
During propagation, AI models undergo a form of evolution. With each subsequent infection, the parent model passes its notes on errors and successful solutions to the offspring.
Thanks to this, the percentage of successful system deployments increases from 45 percent in the first generation to 84 percent in subsequent ones.
How does an AI worm differ from conventional viruses?
Traditional botnets are created for specific types of devices and operating systems.
An AI worm is not tied to specific code and can independently select the required software versions for completely different hardware—from Jetson Nano microcomputers to Mac-based PCs.
At the same time, the speed of propagation of such a virus is considered low. Doubling the number of infected devices takes from several days to a week.
Stopping such a network is extremely difficult due to the absence of a single command center.
Protection and countermeasures
Experts note that such threats can be detected by characteristic anomalies in network traffic. The transfer of many gigabytes of AI model weights between household devices creates atypical load on communication channels.
The main lines of defense are:
- Restricting access for infected devices through providers;
- Closing open ports;
- Manufacturers abandoning the use of default passwords in smart devices.
