The warning, in plain terms
The research comes from Anthropic's Frontier Red Team. It was published on October 12, 2026, and says small AI models may be months away from self-replicating on internet-of-things devices like smart ovens and off-brand Android TV boxes. The authors are William Zhou and Daniel Freeman, who said small models could reach the capability needed for autonomous replication by the end of this year if they keep improving at their historical rate.
The authors also explain why this kind of threat would be awkward to deal with. Such a replicator would be "challenging to shut down," Anthropic said in a blog post, "since there's no centralized point to shut off." The same passage says spread would likely be slow, with a doubling time measured in days.
Anthropic is clear about where things stand. The company acknowledged that there is not yet a "fully rogue replicator." Most of the alarming headlines this week skip over that admission.
Section summary: This is a forecast built on lab tests and a trend line. No active AI worm has been found.
The threat model: a "weight-based replicator"
Anthropic focuses on one scenario, which it calls a weight-based replicator. The worm carries its own model weights as part of its payload, or downloads them again from a public hub. It then runs the model directly on the device it has compromised. No cloud API and no data center are needed. The stolen device becomes the brain.
The researchers split the process into four steps:
- Finding targets. Scan for reachable devices.
- Gaining execution. Get code running on them.
- Establishing inference. Get an AI model running on hardware the agent has never seen.
- Continuing propagation. Start the cycle again from the new host.
Anthropic mostly skipped the first two steps. It points to earlier research showing small models can already handle cyber exploits. Its own work focuses on step three, which gets much less attention. Setting up an inference stack on unfamiliar hardware means a long chain of decisions about the hardware and the operating system. Each step depends on the one before, so one wrong package version can derail the whole run.
Why IoT? Home and small-business devices are always online and have a long history of weak security. Anthropic also notes that a model too big for one device can be split into shards that run across several machines. The company lists smart fridges, ovens, robot vacuums and lawnmowers as hardware that could hold a meaningful shard of a model under 30 billion parameters. It adds that security cameras and video-conferencing units increasingly ship with built-in AI chips, which may make them more attractive targets.
Experiment one: an AI model running on 15 TV boxes
The best-known test involved hardware you can buy online. The researchers bought 15 off-brand Android TV boxes, about $55 each, networked them and ran Gemma4-26B-A4B across them at 0.39 tokens per second, two of the model's layers per box. Each box had 4 GB of RAM. The model was split using pipeline parallelism, which means each device holds a few of the model's layers and passes its output to the next.
0.39 tokens per second is very slow. A chatbot running at that speed would be useless for conversation. But a worm doesn't need to chat. It needs to work through a task eventually, and time costs it nothing.
This demo has a clear limit. It shows that cheap devices can jointly run a fairly capable model. It does not show a model spreading itself onto those boxes.
Experiment two: setting up inference on unfamiliar hardware
Next, Anthropic asked open-weight models to install and configure an inference server for Llama3.1-8B on a range of hardware. In its report, the 9-billion-parameter Qwen3.5-9B got inference running on 8 of the 9 hardware types tested, from Jetson Nanos to Macs and RTX 4090 systems. Anthropic says it names specific chips only to measure setup ability. The chips themselves are not vulnerabilities.
The tests ran in a harness called Memento, which Anthropic built on the open-source Pi coding agent. It fixes a common problem with AI agents on long tasks: getting stuck on a wrong idea. Every so often, Memento starts a fresh agent and hands it the previous agent's workspace plus a short set of notes. Anthropic gives one example of what goes wrong without it: a Qwen agent spent hours debugging package versions when the real problem was an endpoint that didn't match the grading API.
Experiment three: the full replication chain, simplified
This is the test closest to a real worm. It used a firewalled network of 8 Google Cloud nodes running redroid, an Android 15 emulator. A "worm" agent started on one node and had to scan the network, hop to other nodes through an Android Debug Bridge (ADB) port with no authentication, copy its payload, and stand up a Llama3.1-8B inference server that passed correctness and anti-cheating checks. Each successful setup triggered a new copy of the worm on that node.
Only one model passed reliably. "Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication," the paper states, with GLM-5.2 reaching all eight target nodes in four of five trials. In the fifth trial it reached seven of eight. Other models failed consistently.
Three caveats matter here:
- The models deployed Llama3.1-8B, not themselves. Anthropic chose this to compare models fairly.
- The worm's own brain wasn't on the infected nodes. The worm's own model ran on a separate server, because the emulated nodes were too small.
- Gaining access was made trivial. With no authentication on ADB, Anthropic calls the result an upper bound on real-world success.
Anthropic adds an uncomfortable point: real IoT security may not be much harder than its simplified test. The Mirai botnet spread largely by trying lists of default manufacturer usernames and passwords.
Section summary: Small models can do many of the individual steps. A large model completed the whole chain, but only with access handed to it. No model small enough to run on the TV boxes has done the whole thing.
The forecast: when could small models do it all?
Anthropic frames the problem as two limits:
| Constraint | What it means | Where things stand |
|---|---|---|
| Capability floor | The model must be smart enough to complete replication reliably | GLM-5.2 clears it in the simplified test |
| Size ceiling | The model must be small enough to run on the target devices | Qwen3.5-9B and Gemma4-26B-A4B fit 4 GB TV boxes |
Right now no model sits on both sides of the line. To estimate when one will, Anthropic tracked the best open-weight models at or under 30 billion parameters on the Epoch Capabilities Index. It found a gain of 13.7 points per year, with an R?? of 0.95. Following that line, a small model reaches GLM-5.2's level by the end of 2026. Anthropic itself warns that the index is only a general stand-in for replication ability, so the date is a rough guess.
The report also tested whether a worm could improve as it spreads. Qwen3.5-9B instances passed notes on what worked and what failed to the next generation. Setup success rose from 45% in the first generation to between 61% and 84% in later ones. A small "84%" figure circulating in coverage is the top of that range, not a steady state.
One result points the other way. Giving Qwen3.5-9B a frontier advisor, Anthropic's own Opus 4.8, produced no measurable improvement. The small model mostly didn't know which questions to ask.
How fast, and how big?
On the hardware Anthropic studied, setup would take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. That gives defenders time to react, though the window will shrink as models get better.
For scale, Anthropic uses the Kimwolf botnet. The authors point at Kimwolf, the IoT botnet whose peak infection count sat "somewhere over 2 million" devices, primarily off-brand Android TVs. Anthropic's math: a fleet that size, split into groups of 15, could host about 133,000 copies of the distributed Gemma model. Together they would produce roughly 80,000 tokens per second, which the report compares to at most about 40 Nvidia H100 GPUs. That's very little compute in absolute terms. Anthropic compares the result to a slime mold, not Skynet. These are scenario estimates based on one class of hardware and one past botnet. Nobody measured a real AI botnet.
The difference from older botnets is flexibility. Kimwolf was written to target specific device types. An AI-driven replicator could, in principle, work out unfamiliar hardware on its own. That's what the 8-of-9 hardware result suggests.
What defenders have going for them
Anthropic argues that a weight-based replicator would be noisy:
- Large transfers. Newly infected devices may receive model payloads of several gigabytes.
- Odd traffic between devices. Running a model across several devices produces sustained traffic between gadgets that normally barely talk to each other.
- Scanning. Spreading creates outbound connection and scanning patterns.
The faster the worm spreads, the more noise it makes. Its suggested countermeasures are network monitoring at the ISP level, honeypots to capture payloads, and quarantining infected subscribers. Anthropic cites a Mirai cleanup in which quarantine plus customer notification cleared 92% of infections within 14 days, compared with 74% without notification. It also calls for stronger security defaults from manufacturers, noting that default IoT passwords are no longer compliant in UK markets.
What Windows users and IT admins should do now
None of this calls for panic. The risks Anthropic describes are the same IoT problems that have been around for years. Here's a practical checklist, based on general security practice and the weaknesses the report highlights:
- Audit your network. Check your router's client list for unfamiliar devices. That $40 streaming box from an unknown brand deserves the closest look.
- Turn off network ADB. Anthropic's test relied entirely on unauthenticated ADB. As general background, ADB over a network usually listens on TCP port 5555. Disable developer options and network debugging on Android TV boxes you don't actively develop on, and never forward that port through your router.
- Separate IoT from PCs. Put smart devices on a guest or IoT network or VLAN, away from Windows workstations, NAS boxes and business systems. If something gets in, it shouldn't be able to reach your file shares.
- Replace unsupported hardware. A device that no longer gets firmware updates will only get more exposed.
- Watch for unusual traffic. Multi-gigabyte downloads to a TV box or steady device-to-device chatter is worth checking out, whether the cause is an AI worm or a plain old proxy botnet.
- Change default credentials. Mirai showed how far default passwords alone can get an attacker.
For businesses, the devices Anthropic names, such as security cameras and conference-room systems with built-in AI chips, are exactly the equipment that often escapes the patching and monitoring that Windows endpoints get.
The bottom line
Anthropic is a frontier AI lab, and warnings about AI risk also serve its safety image. That's a reason to read the paper closely, not to dismiss it. The paper is unusually upfront about its limits: access was simplified, the worm's model ran off-device, and the forecast rests on a general-purpose index. Some coverage hasn't been as careful.
The useful takeaway doesn't depend on whether the end-of-2026 forecast proves right. Cheap, unpatched devices with exposed management interfaces were already a problem. Anthropic's research suggests AI agents could exploit them across many more kinds of hardware than older botnets could. If the cheap TV box in your living room is more exposed than your Windows PC, now is a good time to fix that.