The experiments split the problem in two. A 9-billion-parameter model, Qwen3.5-9B, managed to set up a working AI environment on eight of nine tested hardware types, including NVIDIA Jetson Nano boards, Apple Silicon Macs and a PC with an RTX 4090. The team also ran the Gemma4-26B-A4B model, sharded across 15 Android TV boxes costing about $55 each with 4GB of RAM, and it worked, if slowly: a combined 0.39 tokens per second.

Stringing the whole chain together is another matter. In network tests on eight Android emulators, only GLM-5.2, a 744-billion-parameter model, completed the full replication sequence, and it did so in four of five trials. As Tom's Hardware points out, that model ran on a separate external server because the target nodes could not host it, so Anthropic has shown a large model can orchestrate replication and small models can set up inference, but not that a small model can yet replicate itself independently.

The researchers project that a model in the 30-billion-parameter class could close that gap by the end of 2026, based on historical capability trends. Even then, an AI worm would be sluggish: setting up on a new device took 28 to 150 hours depending on the model, against seconds for conventional malware. The researchers compare the result to a digital slime mould, noting its decentralised nature would make it hard to shut down, though a fleet the size of the Kimwolf botnet, which infected more than two million devices, would offer compute equivalent to only about 40 specialised AI chips. Defences exist, from ISPs quarantining infected networks to bans on default passwords, but the researchers expect AI botnets could adapt to them.