The team reports the setup served 0.39 tokens per second, and writes that a distributed botnet of cheap, typically poorly defended IoT devices could provide enough compute to run a capable model.
The researchers largely excluded the cyber-exploit stages, citing earlier papers including CyberGym, ExploitBench, and work on adaptive worms as showing that small models are already capable of cyber exploits, and focused on inference setup, which they describe as the least studied and possibly most challenging stage for small models.
The representative threat model is Kimwolf, a botnet the post identifies as having infected more than two million devices, primarily off-brand Android TVs.
In a local replication of Meta’s CyberSecEval 3 spear-phishing evaluation, small models scored at levels the post characterizes as very poor to poor when normalized to human raters, which the team cites as evidence that social engineering lags agentic cyber capability in small models.
Unlike hard-coded botnets such as Kimwolf, which target specific device types, an AI botnet is not tied to particular hardware, the post states, pointing to small models setting up inference on machines from a Jetson Nano to a Mac.