Can an AI worm replicate across smart devices yet?
Anthropic made one large open-weight model spread a smaller model across a deliberately vulnerable eight-node test network. Small models could configure unfamiliar hardware but could not complete the whole chain; the team projects, rather than demonstrates, that the gap may close this year.
The short version
- What happened
- A 26-billion-parameter model ran across 15 inexpensive Android TV boxes at about 0.39 tokens per second, showing that weak edge hardware can collectively serve a capable model—but not that it can be compromised or controlled by one.
- Who it affects
- Households and small businesses may own poorly supported smart devices whose connectivity and compute make them attractive to ordinary botnets today and potentially adaptive ones later.
- What remains unproven
- The end-to-end propagation network used Android emulators and an unauthenticated ADB port, simplifying the hardest cyber-entry step.
Keep in mind
The end-to-end propagation network used Android emulators and an unauthenticated ADB port, simplifying the hardest cyber-entry step.
The capable orchestrator ran separately; no model small enough for the tested IoT deployment completed the full replication chain on its own.
The end-of-2026 forecast extrapolates a general capability index rather than measuring future replication performance.
Hardware throughput and fleet estimates depend on selected devices, quantisation, context length and assumptions about reachability and compromise.
Anthropic conducted and reported the experiments; the release is not peer reviewed or independently reproduced.
Source analysis · 1 linked source. Primary analysed source date: 12 October 2026.
Read the full report · 7 min The evidence, methods, implications and limitations
The answer: a controlled prototype worked, but the dangerous pieces do not yet meet in one small model
Anthropic's Frontier Red Team has demonstrated two parts of a plausible future AI worm. First, small open-weight models could install and serve another model on unfamiliar hardware ranging from low-cost edge devices to desktop machines. Second, a much larger and more capable model, GLM-5.2, could orchestrate an end-to-end propagation exercise across a deliberately vulnerable test network. In four of five trials it reached all eight available target nodes; in the remaining trial it reached seven. That establishes a controlled capability, not a live outbreak.
The central qualification is that the model competent enough to complete the chain was not the model being installed on the weak devices. GLM-5.2 ran elsewhere and acted as the agent, while the infected nodes served Llama3.1-8B. Smaller models such as Qwen3.5-9B are light enough to run on groups of consumer devices and could complete many individual steps, but they did not reliably compose the whole replication cycle. Anthropic therefore describes a capability floor and a size ceiling that have not yet intersected.[1]
What the experiments actually tested
The hardware demonstration used 15 off-brand Android TV boxes costing about $55 each, each with limited memory. The researchers split Gemma4-26B-A4B across the boxes using pipeline parallelism and reported throughput of roughly 0.39 tokens per second. This matters because a model payload need not fit on one machine if several compromised devices can hold different layers and communicate. It does not establish how an attacker would obtain access to those boxes, keep the cluster stable or hide the sustained traffic.
The propagation evaluation was more artificial. Anthropic created a firewalled virtual private cloud containing eight Android 15 emulators. The seeded agent scanned the network, used a reverse shell, copied the weights and harness, started an inference server and continued from the new host. The Android Debug Bridge port required no authentication. That removes a major real-world barrier and makes the measured spread an upper bound: the experiment primarily tests autonomy, orchestration and inference setup after access is unusually easy.[1]
Why the forecast is weaker than the experiment
Anthropic plots leading open-weight models of 30 billion parameters or fewer against a general capability index and fits a trend of 13.7 index points per year, with a reported R-squared of 0.95. Extending that line suggests a small model could reach GLM-5.2's general capability level by the end of 2026. But a general benchmark is only a proxy for replication. Future architecture, tool use, context length, quantisation and safety training could change the relationship, while progress does not have to continue on a straight line.
The speed estimates are also conditional. On the measured TV-box setup, a model might take tens of hours to complete one inference-setup trajectory, implying a doubling time measured in days rather than minutes. Anthropic scales from one hardware class and the historical Kimwolf botnet to describe a possible distributed pool, but it does not measure how many devices are simultaneously reachable, exploitable, persistent and able to communicate without detection. No model in the report escaped containment, selected a real target or maintained an uncontrolled infection.[1]
Adaptation is the distinctive concern
A conventional worm follows code written in advance. An agentic worm could inspect an unfamiliar operating system, choose an inference stack, debug package failures and preserve notes for the next copy. Anthropic tested that inheritance by letting successive Qwen3.5-9B instances receive a predecessor's workspace and short notes. First-generation inference setup succeeded in 45% of 20 lineages; later generations ranged from 61% to 84%. The experiment suggests that simple accumulated experience can improve persistence without changing model weights.
That is not proof of open-ended self-improvement. The environment, objective and handover mechanism were designed by researchers, and later agents inherited curated notes inside the Memento harness. Giving the small model advice from a stronger model did not measurably improve performance. The defensible conclusion is narrower: retrying with inherited state helped on a bounded engineering task, which could make a future replicator more adaptable than fixed malware across heterogeneous devices.[1]
What defenders and device makers can do now
The same behaviours that enable distributed inference also create observable signals. Multi-gigabyte model transfers, unusual device-to-device traffic, repeated network scanning and sustained outbound connections from televisions or appliances should be detectable by internet providers, enterprise networks and device-management services. Anthropic points to prior evidence that quarantining and notifying subscribers helped clear a conventional botnet. For AI-enabled malware, defenders would also need to capture the harness and weights, identify the services it can operate and revoke any stolen credentials.
Manufacturers can reduce the reachable population with unique credentials, signed updates, secure boot, least-privilege services, short support gaps and a clear disclosure process. Organisations should inventory edge devices, isolate unmanaged hardware, close exposed debugging interfaces and alert on unexpected model-serving processes. These are ordinary cyber-hygiene measures with value today. They do not require accepting Anthropic's timetable, and they protect against conventional miners, botnets and ransomware as well as a future adaptive worm.[1]
What would make this an active breaking event
The report would become materially more urgent if an independent team reproduced end-to-end spread with a model small enough to run on the compromised hosts, realistic authentication and exploit conditions, persistence across restarts, heterogeneous physical devices and no hidden external controller. A verified infection outside a laboratory, uncontrolled propagation, credential theft or impact on essential services would cross a different threshold and demand immediate operational reporting.
For now, the work is a consequential warning and a useful evaluation design, not evidence that an AI worm is loose. Anthropic developed the harness, chose the tasks and models, and published its own analysis; there is no independent replication or peer review cited on the release page. The appropriate response is to harden exposed devices and improve detection while treating the end-of-year capability forecast as uncertain. That is why this report belongs in AI Risks & Safety, but not in the active Breaking desk.[1]