The Worm Has No Chokepoint

The most important AI safety document this week was a product launch.

On Tuesday, Liquid AI shipped LFM2.5-24B-A2B, a 24-billion-parameter reasoning model with only 2 billion parameters active per token. Liquid pitches it for “fast, private agents on-device.” On Wednesday, Ars Technica reported that Anthropic is warning that small open-weight models could soon copy themselves across IoT devices, and that by next year they may be able to do it autonomously. These are the same story. It just came out as two press releases.

Look at what Liquid is selling. Because only 2B parameters fire per token, “each reasoning token is cheap, so you can run agents continuously on your own hardware.” It thinks before it answers, calls tools, and works through multi-step tasks. On LiveClaw, an agentic benchmark, it scores 48.09 against 38.19 for Qwen3.6-35B-A3B, a model with roughly 50% more total and active parameters. That’s the efficiency curve compounding in public. Smaller, cheaper, local, always on.

Now read that list as an attacker. Cheap to run, so it fits on weak hardware. Local, so nobody upstream can revoke an API key. Agentic, so it can work out an unfamiliar environment by itself. Anthropic’s researchers ran small open-weight models on real or simulated low-cost, off-brand Android TV boxes and other IoT hardware. Their conclusion: a replicator like this “would be challenging to shut down, since there’s no centralized point to shut off.” Unlike ordinary malware, “it could also figure out unfamiliar devices on its own.” The features that make a private agent private are the same features that make a worm hard to kill. That isn’t a knock on Liquid. Liquid is just shipping where the curve was always going.

Now look at Washington’s main tool. In June the Trump administration issued Executive Order 14409. Adam Conner, writing in Lawfare, calls the result a de facto AI model licensing system. The framework hasn’t been published. Outsiders don’t know which models it covers, who gets access, or whether it limits sharing models with foreign governments. Set the secrecy aside and look at the design. Licensing is a chokepoint tool. It works when the capability sits in a few data centers run by a few companies whose general counsels take the government’s calls. It gives the regulator leverage over whoever is inside the perimeter.

The threat Anthropic describes is defined by having no perimeter. No center, no kill switch, no counterparty to call. Every regulation hands optionality from the regulated to the regulator. Here, the regulated party isn’t the one doing the damage.

The best counterargument goes like this. Small models are distilled from big ones, so if you control the frontier, you control the supply of good students. Gate the teacher and you slow the class. I take that seriously, and it holds for the top end, where the scary capabilities show up first. But it breaks on the timeline. The models Anthropic tested are already open, and the boxes they ran on are already sold. You can’t un-ship weights. At best, gating the teacher delays the next generation by a few months. Meanwhile a 2B-active model is competitive with a 3B-active one on agentic tasks this week. A license slows a curve. It doesn’t bend it.

There’s also an incentive question worth saying out loud. A frontier lab warning about small open models looks, to a cynic, like a lab lobbying for rules that hurt its cheaper competitors. Read the finding before you dismiss it. Anthropic’s own scenario is the best argument against relying on frontier licensing, because the worm it describes doesn’t need a frontier lab at all. Ars notes the experiment ran into significant challenges in building a working replicator. Anthropic’s own caveat is that such a replicator “may be slow (with a doubling time of days).” That’s the most honest line in the post, and the most useful one.

Days is a window. That’s where my optimism comes in, and I’m treating optimism as a strategy, not a mood. If the threat lives at the edge, the defense has to live there too. That means the cheap off-brand box, the kind of device that ships once and never gets touched again. It means real security baselines and update obligations for connected hardware, enforced at the point of sale, where the leverage is. It means network-level detection that watches for strange inference workloads on devices that should be streaming video. And it means the same efficient local models running as defenders on the same class of hardware. The curve that makes the worm cheap also makes the immune system cheap. Someone just has to build it before the other side does.

The stakes are about where policy spends its credibility. If Washington spends it on a secret licensing regime at the top of the stack, it will have nothing left when the first replicator turns up at the bottom, inside a TV box nobody remembers buying.

You can license a lab. You can’t license a toaster.