Viruses don't need to be intelligent at all and smart viruses (or AI internet worms) won't need to be superintelligent to be a real pain to deal with. DoS attacks due to scraping are bad enough already.

The situation is sort of like the Internet before broadband. There probably aren't enough AI-capable home machines to have big swarms of bots that run autonomously. If the swarm depends on an LLM API, it will be easier to cut it off once it's noticed.

I think it's an even chance that we will see a bot swarm in the wild (rather than coming from an AI lab) by the end of next year.