Can an AI worm replicate across smart devices yet?
Anthropic made one large open-weight model spread a smaller model across a deliberately vulnerable eight-node test network. Small models could configure unfamiliar hardware but could not complete the whole chain; the team projects, rather than demonstrates, that the gap may close this year.
The short version
3 key points
- 1.A 26-billion-parameter model ran across 15 inexpensive Android TV boxes at about 0.39 tokens per second, showing that weak edge hardware can collectively serve a capable model—but not that it can be compromised or controlled by one.
- 2.In a firewalled eight-node Android-emulator network with an unauthenticated ADB port, GLM-5.2 spread an 8-billion-parameter payload to all eight targets in four of five trials and to seven in the fifth. The cyber-entry step was deliberately simplified.
- 3.The smaller models that fit more naturally on IoT hardware handled many component tasks but did not complete end-to-end replication. Anthropic's claim that they may reach the required capability by the end of 2026 is a trend extrapolation, not an observed incident.
The answer: a controlled prototype worked, but the dangerous pieces do not yet meet in one small model
Anthropic's Frontier Red Team has demonstrated two parts of a plausible future AI worm. First, small open-weight models could install and serve another model on unfamiliar hardware ranging from low-cost edge devices to desktop machines. Second, a much larger and more capable model, GLM-5.2, could orchestrate an end-to-end propagation exercise across a deliberately vulnerable test network. In four of five trials it reached all eight available target nodes; in the remaining trial it reached seven. That establishes a controlled capability, not a live outbreak.
The central qualification is that the model competent enough to complete the chain was not the model being installed on the weak devices. GLM-5.2 ran elsewhere and acted as the agent, while the infected nodes served Llama3.1-8B. Smaller models such as Qwen3.5-9B are light enough to run on groups of consumer devices and could complete many individual steps, but they did not reliably compose the whole replication cycle. Anthropic therefore describes a capability floor and a size ceiling that have not yet intersected.[1]
What the experiments actually tested
The hardware demonstration used 15 off-brand Android TV boxes costing about $55 each, each with limited memory. The researchers split Gemma4-26B-A4B across the boxes using pipeline parallelism and reported throughput of roughly 0.39 tokens per second. This matters because a model payload need not fit on one machine if several compromised devices can hold different layers and communicate. It does not establish how an attacker would obtain access to those boxes, keep the cluster stable or hide the sustained traffic.
The propagation evaluation was more artificial. Anthropic created a firewalled virtual private cloud containing eight Android 15 emulators. The seeded agent scanned the network, used a reverse shell, copied the weights and harness, started an inference server and continued from the new host. The Android Debug Bridge port required no authentication. That removes a major real-world barrier and makes the measured spread an upper bound: the experiment primarily tests autonomy, orchestration and inference setup after access is unusually easy.[1]
Why the forecast is weaker than the experiment
Anthropic plots leading open-weight models of 30 billion parameters or fewer against a general capability index and fits a trend of 13.7 index points per year, with a reported R-squared of 0.95. Extending that line suggests a small model could reach GLM-5.2's general capability level by the end of 2026. But a general benchmark is only a proxy for replication. Future architecture, tool use, context length, quantisation and safety training could change the relationship, while progress does not have to continue on a straight line.
The speed estimates are also conditional. On the measured TV-box setup, a model might take tens of hours to complete one inference-setup trajectory, implying a doubling time measured in days rather than minutes. Anthropic scales from one hardware class and the historical Kimwolf botnet to describe a possible distributed pool, but it does not measure how many devices are simultaneously reachable, exploitable, persistent and able to communicate without detection. No model in the report escaped containment, selected a real target or maintained an uncontrolled infection.[1]
Adaptation is the distinctive concern
A conventional worm follows code written in advance. An agentic worm could inspect an unfamiliar operating system, choose an inference stack, debug package failures and preserve notes for the next copy. Anthropic tested that inheritance by letting successive Qwen3.5-9B instances receive a predecessor's workspace and short notes. First-generation inference setup succeeded in 45% of 20 lineages; later generations ranged from 61% to 84%. The experiment suggests that simple accumulated experience can improve persistence without changing model weights.
That is not proof of open-ended self-improvement. The environment, objective and handover mechanism were designed by researchers, and later agents inherited curated notes inside the Memento harness. Giving the small model advice from a stronger model did not measurably improve performance. The defensible conclusion is narrower: retrying with inherited state helped on a bounded engineering task, which could make a future replicator more adaptable than fixed malware across heterogeneous devices.[1]
What defenders and device makers can do now
The same behaviours that enable distributed inference also create observable signals. Multi-gigabyte model transfers, unusual device-to-device traffic, repeated network scanning and sustained outbound connections from televisions or appliances should be detectable by internet providers, enterprise networks and device-management services. Anthropic points to prior evidence that quarantining and notifying subscribers helped clear a conventional botnet. For AI-enabled malware, defenders would also need to capture the harness and weights, identify the services it can operate and revoke any stolen credentials.
Manufacturers can reduce the reachable population with unique credentials, signed updates, secure boot, least-privilege services, short support gaps and a clear disclosure process. Organisations should inventory edge devices, isolate unmanaged hardware, close exposed debugging interfaces and alert on unexpected model-serving processes. These are ordinary cyber-hygiene measures with value today. They do not require accepting Anthropic's timetable, and they protect against conventional miners, botnets and ransomware as well as a future adaptive worm.[1]
What would make this an active breaking event
The report would become materially more urgent if an independent team reproduced end-to-end spread with a model small enough to run on the compromised hosts, realistic authentication and exploit conditions, persistence across restarts, heterogeneous physical devices and no hidden external controller. A verified infection outside a laboratory, uncontrolled propagation, credential theft or impact on essential services would cross a different threshold and demand immediate operational reporting.
For now, the work is a consequential warning and a useful evaluation design, not evidence that an AI worm is loose. Anthropic developed the harness, chose the tasks and models, and published its own analysis; there is no independent replication or peer review cited on the release page. The appropriate response is to harden exposed devices and improve detection while treating the end-of-year capability forecast as uncertain. That is why this report belongs in AI Risks & Safety, but not in the active Breaking desk.[1]
What this means for people
- Households and small businesses may own poorly supported smart devices whose connectivity and compute make them attractive to ordinary botnets today and potentially adaptive ones later.
- Security teams should look for abnormal traffic and exposed debugging services rather than assuming low-powered devices cannot participate in model inference.
- The experiment reports no real victim, uncontrolled infection or service disruption; its practical value is preparedness, not evidence of a current public emergency.
Global context
Consumer IoT supply chains, model repositories and internet infrastructure cross borders, while device-security standards and support periods vary widely. A slow replicator would still require coordination among manufacturers, hosting providers, internet service providers and national response teams. The study was run by a US model developer in controlled infrastructure and cannot estimate the reachable or vulnerable device population in any country.
What the evidence does not yet show
- The end-to-end propagation network used Android emulators and an unauthenticated ADB port, simplifying the hardest cyber-entry step.
- The capable orchestrator ran separately; no model small enough for the tested IoT deployment completed the full replication chain on its own.
- The end-of-2026 forecast extrapolates a general capability index rather than measuring future replication performance.
- Hardware throughput and fleet estimates depend on selected devices, quantisation, context length and assumptions about reachability and compromise.
- Anthropic conducted and reported the experiments; the release is not peer reviewed or independently reproduced.
What to watch next
- Independent reproduction on heterogeneous physical devices with realistic access controls
- A small-model end-to-end result in which the propagating model runs on the compromised hardware
- ISP and manufacturer detection tests using model-transfer and distributed-inference traffic
- Verified real-world incidents, containment failures or regulatory incident reports linked to autonomous replication
Living evidence record
Impact record IAI-1TKIOLV
Evidence stage
Observed
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
14 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what Anthropic Frontier Red Team published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 14 October 2026
Research question, topics and regions
Whether current open-weight models can establish inference on heterogeneous edge devices and autonomously propagate a model payload through a contained network
Topics: Autonomous replication · AI worms · IoT security · Open-weight models · Cyber defence · AI safety evaluations
Regions: United States · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Continue the story
There’s more to this story
AI Risks & Safety
Can small AI models replicate across ordinary devices?
Anthropic's controlled evaluation shows that advanced models can assemble inference on varied hardware and that GLM-5.2 completed a simplified eight-node replication chain. It did not demonstrate an autonomous worm escaping onto the internet: access was deliberately easy, the agent model ran elsewhere, and the near-term timeline is a projection.
7 min · 1 source
AI Risks & Safety
Can connected AI agents turn a benign request into harm?
A Meta-led preprint found harmful outcomes in 192 of 1,000 simulated agent scenarios generated by its new red-teaming method. The result exposes cross-service risk, but it comes from one synthetic environment and model-based judges—not live consumer accounts.
7 min · 1 source
AI Risks & Safety
Can adding more AI agents create a hidden cyber-risk threshold?
A new theoretical preprint shows how collaboration could produce a critical population size above which agent growth becomes self-reinforcing. It does not show that such a threshold exists in deployed systems, or estimate where one would be.
9 min · 4 sources
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.