Small artificial intelligence models may be only months away from being able to behave like a computer worm — copying themselves from one internet-connected gadget to the next without human help. That is the warning from Anthropic’s Frontier Red Team, which published new research on October 12 showing that the pieces of a self-replicating “AI worm” are falling into place faster than many defenders expected.

The research, by Anthropic researchers William Zhou and Daniel Freeman, argues that a runaway AI replicator would no longer need powerful data centers to operate. Instead, it could run on networks of cheap, poorly secured consumer devices: off-brand Android TV boxes, smart ovens, security cameras and video-conferencing units.

The $55 lab: an AI running on 15 TV boxes

The team’s most striking demonstration is deliberately low-budget. The researchers bought 15 inexpensive off-brand Android TV boxes — roughly $55 each, with 4GB of RAM — networked them together, and ran Google’s open-weight Gemma4-26B-A4B model distributed across all of them. Each box held a slice of the model’s layers, and together they served inference at 0.39 tokens per second. Slow, but functional.

The point, according to the researchers, is that a capable AI model no longer needs a data center. A model too large to fit on one device can be split into shards that run on separate machines which communicate to collectively serve the model. Anthropic estimates that with 4GB of RAM per box at 4-bit quantization, 9-billion-parameter models could run across as few as four machines, and 26-billion-parameter models across ten or more.

In a second set of tests, the team measured whether models can set up inference on unfamiliar hardware. A smaller 9-billion-parameter model, Qwen3.5-9B, successfully set up working inference servers on 8 of the 9 distinct hardware types tested — ranging from Nvidia Jetson devices to Macs and other edge hardware. Machines that could run a significant model shard, the researchers wrote, already include smart fridges, smart ovens, automatic vacuum cleaners and lawnmowers — and a growing number of home and business devices now ship with small built-in AI chips designed to run AI models on the device itself.

The replication chain: one model crosses the line

The harder question is whether a model can chain the full replication cycle together: scanning a network for targets, breaking in, copying its weights over, starting inference on the new host, and repeating. Anthropic broke the process into four stages — finding targets, gaining execution, establishing inference, and continuing propagation — and tested models end to end in a contained, firewalled test network of eight emulated Android devices with an open, unauthenticated debug port.

Only one open-weight model completed the full chain reliably: Zhipu AI’s GLM-5.2. According to the research, it spread to 8 of 8 nodes in 4 out of 5 trials, and 7 of 8 in the fifth. Smaller models completed individual steps but struggled to chain them together end to end.

There is an important caveat the researchers state openly: the cyber-exploit portion of these tests was kept deliberately trivial — there was no authentication on the debug port — making the results an upper bound on real-world success rates, not a measurement of them. No rogue replicator exists today, and the models in the tests were instructed to replicate rather than choosing to do so on their own.

A botnet with no off switch

What worries the researchers is not speed but persistence. They liken the likely result to a slow “digital slime mold” rather than a fast-moving virus, with each new copy taking a day or two to set itself up. But once established, such a replicator would be unusually hard to stamp out, because there would be no central server to unplug. “A replicator like this would be challenging to shut down, since there’s no centralized point to shut off,” the researchers wrote.

Anthropic sized the hypothetical threat against Kimwolf, a real IoT botnet that infected more than two million devices at its peak — mostly off-brand Android TV boxes. At that scale, the researchers estimate roughly 133,000 copies of a 26-billion-parameter model could run across such a fleet, worth about 40 Nvidia H100 GPUs of compute. Small next to a data center, but enough to keep running out of sight.

The researchers also tested whether replicators could learn as they spread. Across six generations of Qwen3.5-9B, each inheriting notes from the previous generation, the share of runs completing inference setup rose from 45% in the first generation to between 61% and 84% in later ones. When the team gave the small model access to Anthropic’s far stronger Opus 4.8 as an adviser, it made no measurable difference.

A forecast, not a countdown

The headline projection — that models of 30 billion parameters or fewer could reach GLM-5.2’s capability level by the end of 2026 — is explicitly a forecast built on a proxy metric, Anthropic’s own Epoch Capabilities Index trend line, which the researchers describe as a rough estimate rather than a hard prediction.

Still, the direction is what matters for defenders. Unlike a conventional botnet that targets one device type with a fixed exploit, a model-driven replicator can improvise against unfamiliar hardware. Anthropic’s recommendations are aimed at industry rather than panic: internet providers should watch for multi-gigabyte model transfers and unusual device-to-device traffic, quarantine infected customers and notify them, and use decoy devices to catch any replicator for study. The researchers also point to the UK’s ban on default passwords for connected devices as the kind of rule that shrinks the pool of easy targets.

For households, the advice is the boring kind that works: change default passwords, install updates, retire devices that no longer receive them, and be wary of bargain streaming boxes from unknown brands. Cheap no-name gadgets with default passwords and open ports have powered botnets like Mirai for a decade. Anthropic’s argument is that they could now become hosts for AI too — a concern that dovetails with growing scrutiny of what AI agents can access on personal devices, and with the industry’s broader debate over open-weight models.

Frequently asked questions

Has a self-replicating AI worm been found in the wild?
No. Anthropic’s research is a controlled capability demonstration, published October 12 by its Frontier Red Team. No fully autonomous replicator exists today, and the models in the tests were instructed to replicate rather than doing so on their own.

What did Anthropic’s experiment actually prove?
Two things: that a 26-billion-parameter model can run distributed across 15 cheap Android TV boxes, and that one open-weight model (GLM-5.2) could complete the full replication chain across eight test nodes in 4 of 5 trials — in a simplified lab setup with security barriers deliberately removed.

Why would an AI worm be hard to stop?
Because there is no central server to unplug. A model scattered across millions of cheap household devices would have no single kill switch, though it would spread slowly — on the order of days to double in size on cheap hardware.

What should I do to protect my devices?
Change default passwords, keep firmware updated, retire devices that no longer get updates, and avoid bargain smart gadgets from unknown brands with weak security. The same habits that defeat ordinary botnets work here.

Primary source: Anthropic Frontier Red Team, “AI models may be capable of self-replicating without access to a datacenter” (October 12, 2026).*