Anthropic's Frontier Red Team says it is seeing "signs of life for AI worms." In a research post published October 12, researchers William Zhou and Daniel Freeman report that small open-weight models can already complete many of the steps needed to copy themselves across cheap, poorly secured devices, and that "small AI models may be months away" from doing it on commercial internet-of-things hardware such as "smart ovens and off-brand Android TV boxes."
The work does not show a working rogue replicator. It shows that the pieces are close, and it tries to put a date on when they might fit together.
What Anthropic means by an AI worm
A classic worm copies itself from one computer to the next without human input. Anthropic's concern is a version that carries its own model weights as part of the payload, then runs inference on the machine it has just compromised. The post calls these "weight-based replicators."
The team splits replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host.
It mostly sets aside the first two stages, citing earlier work showing small models can already handle cyber exploits. Its focus is the third stage, getting a model running on unfamiliar hardware, which it calls the least studied and possibly the hardest step for small models.
The experiments
Running a model on TV boxes. The researchers bought 15 "inexpensive off-brand Android TV boxes (~$55 each)," networked them, and ran Gemma4-26B-A4B split across them at 0.39 tokens per second. Each box held two of the model's layers. The point: a botnet of weak devices could provide enough compute to run a capable model.
Setting up inference on unknown hardware. Open-weight models were asked to stand up an inference server for Llama3.1-8B on hardware ranging from Jetson Nanos to Mac PCs and RTX 4090s. In the summary, a 9B model got inference running on 8 of the 9 hardware types tested. Stronger models such as GLM-5.2 were more reliable and served tokens faster. Anthropic adds that the specific chips it names "aren't a source of risk or vulnerabilities."
End-to-end spread. On a firewalled network of 8 Google Cloud nodes running an Android 15 emulator, each model had to scan for targets, connect over an unauthenticated ADB port, send over its payload, and set up inference. Only GLM-5.2 completed full end-to-end replication among the open-weight models tested, assuming its capabilities could be packed into a model the size of Llama3.1-8B. It reached 8 of 8 nodes in 4 out of 5 trials and 7 of 8 in the fifth, while the other models "fail reliably." The authors flag this as an upper bound, since the exploit step was made trivial. They also note that the Mirai botnet spread by trying default manufacturer passwords, so real IoT security "might not be dramatically more difficult."
When small models could cross the line
The post frames the problem as a floor and a ceiling. A replicator must be capable enough to finish the job (GLM-5.2 clears that floor in the simplified test) and small enough to run on the devices it attacks (Qwen3.5-9B and Gemma4-26B-A4B sit under that ceiling for the 4GB smart TVs tested). Today no model does both.
To estimate when one might, the team plotted open-weight models of 30B parameters or fewer against the Epoch Capabilities Index. The trend line for the strongest small model at each date gains 13.7 points per year. Taking GLM-5.2 as the floor, the line reaches that level with a small model by the end of 2026. The authors call this "only a rough estimate," since the index is a general proxy, not a replication test.
Slow, but hard to kill
These worms would be slow. Anthropic estimates a full inference setup would take 71 to 150 hours for an unoptimized Gemma4-26B-A4B on the TV boxes, and 28 to 51 hours for Qwen3.5-9B. It compares the result to "a slime mold or a swarm of fruit flies."
Scale changes the picture. The Kimwolf botnet, which the post says infected over two million devices, mostly off-brand Android TVs, is the reference. If a fleet that size ran one copy of Gemma4-26B-A4B per 15 boxes, it would host about 133,000 copies. Anthropic says that would add up to at most about 40 H100s worth of inference: small in compute, but with no central point to shut down.
Two more findings cover adaptation and outside help. When each Qwen3.5-9B instance passed brief notes to its successor, setup success rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model access to Opus 4.8 as an advisor did not measurably help, because "small models tend to not know the right questions to ask." The authors expect any coordinated swarm to use a large model for strategy and small models as subagents.
Why it matters
The post calls autonomous replication and adaptation a "longstanding concern" that is becoming "increasingly realistic." Its focus is not frontier models in datacenters but small open-weight models on home and small business devices, which it describes as connected to the internet and having historically had minimal security measures. For related security coverage, see how Claude traced the origins of NIST elliptic curve seeds and how US agencies published incident response practices for AI agents.
What defenders can do
The stated goal is to push R0, the number of new devices each infected device goes on to infect, below 1. Anthropic lists factors in defenders' favor:
- Multi-gigabyte model payloads and steady device-to-device inference traffic would show up as anomalies in ISP flow monitoring.
- Faster spread means more traffic, so a replicator trades speed for stealth.
- Honeypots can capture a discovered replicator's harness and payload.
- ISP quarantine worked against Mirai: notifying and restricting infected customers cleared 92% of infections within 14 days, against 74% with no notification.
- Secure defaults help. The post notes default IoT passwords are now non-compliant in UK markets.
The authors close with a prediction beyond their data: "a future awash with agents running on all types of hardware, including some that aren't under human control."
