The next AI cybersecurity nightmare won’t need a data center. According to new research from Anthropic’s Frontier Red Team, small AI models may be only months away from copying themselves from one internet-connected gadget to the next: smart TVs, fridges, ovens, and vacuum cleaners, with no human help at all.
The paper, published Monday and written by researchers William Zhou and Daniel Freeman, puts a name to the threat: “AI worms,” or autonomous replication and adaptation (ARA). A traditional computer worm copies code between machines. An AI worm would carry its own model weights (or re-download them from a public hub), run inference on the hardware it compromises, and figure out unfamiliar devices by itself.
Don’t panic yet. The researchers are describing a projection, not an attack in progress.
The experiment: 15 cheap TV boxes, one self-copying model
Anthropic wanted to answer a deceptively simple question: is cheap hardware enough to run a small AI model? So the team bought 15 off-brand Android TV boxes at roughly $55 apiece, each with 4GB of RAM, networked them together, and ran Gemma4-26B-A4B across the cluster. The setup worked, at about 0.39 tokens per second (glacial by data-center standards, but enough to prove the point).
Then came the replication test. The team broke the problem into four steps: finding targets, gaining code execution, establishing inference, and propagating to new hosts. Of every open-weight model tested, only one cleared the full bar. “Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication,” the paper states. It spread to all eight target nodes in four of five trials. Smaller models fell short on the full sequence but got close on individual steps: Qwen3.5-9B successfully set up inference on eight of nine hardware types thrown at it, and its success rate climbed from 45% to between 61% and 84% as the agent inherited notes across generations.
The researchers were careful about what they actually demonstrated. The exploit elements in the test were kept deliberately “trivial,” including unauthenticated ADB ports. And spear-phishing ability in the small models rated “very poor to poor.” The headline projection, full self-replication by the end of 2026, is a trend extrapolation, they say, not something a 9-billion-parameter model can do today.
Why Anthropic AI worms are hard to kill
Here’s the part that should make security teams sit up. A worm like this would be brutally hard to stamp out once released, because there is no centralized switch to flip. Zhou and Freeman compare its spread to “a slime mold or a swarm of fruit flies”; slow, with a doubling time measured in days rather than minutes, but persistent and decentralized.
The scale argument is what makes it unsettling. The researchers modeled their estimate on Kimwolf, a real IoT botnet that peaked at more than 2 million infected devices, mostly off-brand Android TV boxes. At that size, they calculate, the pool could host roughly 133,000 concurrent copies of Gemma4-26B-A4B, or in compute terms about 40 H100-equivalents of distributed AI. That’s not enough for anything sophisticated. But as the researchers note, a replicator doesn’t need to be useful for anything else. Self-perpetuation is the whole point.
There is a counterweight in the research. Anthropic found that an AI worm would leave a visible network signature — multi-gigabyte payloads and sustained device-to-device traffic are not subtle. And in testing, quarantining the infection fixed it within 14 days. Detectable, containable, but not erasable.
Why this matters
The timing is not coincidental. This research lands as every major tech company is racing to push AI directly onto phones, laptops, cars, and household devices instead of running it only in distant data centers. More edge hardware means more hosts. The researchers’ closing line is blunt: “We expect a future awash with agents running on all types of hardware, including some that aren’t under human control.”
This is also Anthropic playing offense on safety credibility. The same week the company told British lawmakers that voluntary AI pledges aren’t enough, its red team is publishing the kind of paper that makes regulators reach for the phone. A documented, replicable path to self-replicating AI malware, even a partial one, is the sort of finding that turns theoretical policy debates into legislative calendars.
For the average smart-home owner, the practical takeaway is boring and old: change your default passwords, update your firmware, and keep your cheap TV box off your main network. The worm of the future still needs the same dumb door to walk through as the botnets of the past.
Frequently asked questions
What is an AI worm?
An AI worm is malware that carries its own AI model weights (or re-downloads them) and runs inference on each device it infects, letting it find, compromise, and spread to new devices autonomously — what Anthropic calls autonomous replication and adaptation (ARA). Unlike regular malware, it can figure out unfamiliar hardware on its own.
Has Anthropic actually built a working AI worm?
No. The researchers tested the individual steps in controlled lab environments and did not release anything onto the public internet. Only one open-weight model they tested, GLM-5.2, achieved full end-to-end replication, reaching all eight target nodes in four of five trials.
How soon could AI worms actually appear in the wild?
Anthropic projects that smaller models could manage full self-replication by the end of 2026. That is a trend extrapolation, not a demonstrated capability — and the researchers note their estimate is rough, based on one type of gadget and one past botnet.
What can I do to protect my smart home devices?
Change default passwords, keep firmware updated, disable unused remote-access features, and put IoT gadgets on a separate guest Wi-Fi network. Any such worm would leave a visible network signature, like multi-gigabyte payloads and sustained device-to-device traffic, so unusual network activity is a red flag.
Sources: Reuters; Ars Technica