In short
In short: a botnet (from robot network) is a network of infected devices executing someone else's commands without their owners' knowledge. Any machine with internet qualifies: home routers, security cameras, old computers, smart appliances. The botnet operator collects them through mass infection and then rents them out - most often for DDoS floods, spam runs or covering tracks.
The most uncomfortable part: the soldier in that army might be your router. A device with a factory password and skipped updates gets taken in seconds by an automated scanner that sweeps the entire internet around the clock. Nobody chose you. Your door just happened to be unlocked.
The infected device keeps working normally. The camera keeps filming, the router keeps serving internet. That is why nobody notices: the army stays quiet until the operator calls it up.
Nobody builds an army of a million machines. They rent it ready-made, by the hour.
What is new is that the army may learn to look for soldiers on its own. In October 2026 Anthropic's red team linked 15 cheap TV boxes, about 55 dollars each, and ran the Gemma4-26B-A4B model on them. By Anthropic's estimate, small models may be months away from self-replicating across such devices. A worm like that would have no central off switch, but it would be slow. The test was in a closed environment and Anthropic does not claim such an attack has been detected.
What depends on you
Three things, all boring: change the factory password, run the updates, retire the device its maker stopped supporting. You are not only protecting yourself. Every cleaned device is one soldier fewer in someone else's army.
Primary sources
NIST CSRC glossary: botnetAnthropic - AI models may be capable of self-replicating without access to a datacenter, 12.10.2026The visual is generated code-art, no third-party images.