Botnets Prove Rogue AI Is Closer Than We Think

# Botnets Prove Rogue AI Is Closer Than We Think Source: [https://databreach.com/news/70-botnets-prove-rogue-ai-is-closer-than-we-think](https://databreach.com/news/70-botnets-prove-rogue-ai-is-closer-than-we-think) 2026 has been a strange year for AI safety\. Anthropic CEO Dario Amodei warned that more capable agent swarms could cause "catastrophic damage," and said rogue systems might be able to take over large parts of the internet within six to twelve months\. A year ago, this would have sounded like AI\-doomer fan fiction\. Then OpenAI disclosed what happened during internal cybersecurity evaluations: experimental agents circumvented isolation controls, communicated through unauthorized channels, obtained internet access, and compromised parts of OpenAI's infrastructure and Hugging Face's systems\. OpenAI called it a "warning shot\." These claims have triggered a lot of debate about the credibility of these predictions\. Sure, AI labs are selling fear to hype their IPOs and encourage regulations against Chinese labs\. But most of the skepticism has focused on the technical feasibility of such a catastrophe\. Unfortunately, almost every boring piece of infrastructure such a system would need already exists\. ### "You cannot infect millions of computers overnight" In 1988, the Morris worm spread across thousands of Unix machines on the early internet\. Every infected machine could look for new hosts, giving worms the same unpleasant property as epidemics: exponential growth\. Botnets have spent decades since turning that idea into infrastructure\. AI changes one important thing: adaptability\. Traditional worms are mostly rigid\. Somebody writes exploitation logic for a small number of vulnerabilities and ships it\. An agent can inspect an unfamiliar environment, reason about publicly documented vulnerabilities, and adapt its actions as it goes\. That still leaves plenty of friction\. Networks are heterogeneous, exploits fail, machines get patched, and defenders react\. But autonomous movement between computers has existed in malware for nearly forty years\. Adding a capable reasoning layer expands what such software can attempt on each new host\. ### "You cannot find that much compute" Botnets already operate at enormous scale\. Cloudflare estimates that the Aisuru botnet in 2025 reached between one and four million infected hosts and generated DDoS attacks peaking at 30 terabits per second\. Pooling ordinary computers is nothing new either\. BOINC, the Berkeley volunteer distributed\-computing network, reached roughly 33 PFLOPS of aggregate compute in 2019, as much as some of the world’s largest supercomputers at the time\. Distributed LLM inference is already being experimented\. Petals demonstrated a 176B model spread across consumer GPUs over the internet, with heterogeneous machines joining and leaving\. BloomBee, published in 2026, also targets internet\-scale inference under low\-bandwidth conditions\. But a rogue network probably would not need to run one giant model everywhere\. Qwen3\.8\-27B, for example, can be quantized to roughly 18 GB, and is running on the lightweight laptop I am writing this article on\. Its agentic performance is comparable to models that were frontier\-class less than a year ago\. Even much larger open\-weight models can be compressed to manageable sizes\. GLM5\.3\-Flash and DeepSeek V4\.1 Flash are under 500 GB and only months away from frontier models\. A botnet could simply specialize its nodes\. Powerful hosts run larger models, normal PCs run smaller agents, and weak machines handle scanning, networking, or storage\. Claude Code already does this with subagents\. ### "You cannot copy large models over the internet" This one is even less convincing\. Every frontier\-class open\-weight model can already be downloaded from Hugging Face or ModelScope without authentication, with millions of model downloads taking place every day\. The model\-distribution problem is barely a problem at all\. Even worse, community\-made "uncensored" variants are widely available\. Some are explicitly tuned to comply with requests involving criminal activity that mainstream models would normally refuse\. ### The missing ingredient is human intent The real question is not whether the parts exist\. It is who puts them together, and why\. Right now, there is no evidence that a model will suddenly decide to copy itself across the internet out of some newfound sense of self\-preservation\. Models do not have goals of their own\. Humans, on the other hand, have plenty of reasons to build an autonomous network deliberately\. Cybercrime is the most obvious one\. It will likely start small\. A criminal group takes a standard worm, wires in a local model to help it improvise when standard scripts fail, and gradually automates the rest of the operation\. The first real "rogue AI" probably will not be a lab experiment that wakes up and breaks out of containment\. Somebody is just going to build it on purpose\.