The way I read that paragraph is thus; the whole section deals with an AI loading onto a device, from how it's done (Spoof Command or Control Device) to what the requirements are (one program/app slot unless Device Rating is lower than Depth, in which case 2 slots) and through all the effects of having an AI loaded onto a device (too numerous to summarize, but includes stipulations about multiple personas on a device).
When an AI loads onto a device where another persona has already been formed, this "pushes devices past their limits". Since the next sentence doesn't specify whether it applies to the AI, the existing persona, or both, I would assume it applies to both. Also, I think it is fair to assume that since the AI gets 3 MARKs on the device and the other persona gets 3 MARKs on the AI that this is not a subtle act; to my mind, an AI loading onto a device with an existing persona is the equivalent to modern day ransomware being loaded onto your computer as both effectively announce their presence.
Well, I did not find that statement that clear, and your answer actually give me more pause. Indeed, my understanding was that once the AI is loaded, it's taking a program slot and "the other persona" (ie the decker) has -5d - which I honestly finds quite a lot and more/less make it impossible (maybe on purpose) for the AI to sneak into a deck unnoticed.
Yes, it is virtually impossible for an AI to sneak onto a deck if a hacker already has his persona loaded because of the MARKs that are granted.
However, your interpretation below suggests that the -5d applies ONLY when the AI load onto the deck:
Not quite; the negative dice pool applies whenever an AI loads onto a device where a persona already exists, or when a persona is formed on a device the AI has loaded onto, whichever comes first.
So, once loaded the AI takes up one program slot, but does not infers any malus ?
Again, not quite. The key part is that it's the multiple persona running on a single device that is taxing, and any action from either persona that doesn't target the other persona suffers the penalty.
That's how I read the rules, anyway.