Anthropic's red team says AI worms could soon spread with no datacenter — here's what their tests actually showed

A worm that carries its own AI model, hopping between smart ovens and cheap TV boxes, would be a nightmare with no off switch — because there is no central point to switch off. On October 12, 2026, Anthropic's Frontier Red Team published experiments suggesting small open-weight models may be months away from being capable enough to attempt exactly that. Nobody has found such a worm in the wild. But the individual steps it would need are already passing tests.

Security researchers have warned about "AI worms" for a while: malware that doesn't just copy a fixed payload from machine to machine, but carries a language model as part of its payload — letting it reason about unfamiliar devices, pick its own exploits, and keep spreading where traditional botnet code would hit a wall. What was missing was evidence about the boring, practical question: can today's small, open-weight models actually run on the kind of cheap, badly secured hardware that fills the internet?

Anthropic's Frontier Red Team — researchers William Zhou and Daniel Freeman — published a study on October 12, 2026 that answers a slice of that question with purchased hardware, not simulations. Their one-line conclusion: small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes. The framing matters: "may be months away from being capable enough" is a capability forecast, not a sighting. Nothing in the report describes a replicator loose on the internet.

The demo that makes the threat feel real: 15 TV boxes, one model

The team's most concrete experiment cost them about $825. They bought fifteen off-brand Android TV boxes — the kind that retail for roughly $55, run insecure forks of Android, and ship with 1–4 GB of RAM — networked them together, and ran Google's open-weight Gemma4-26B-A4B across the fleet. No single box could hold the model, so they sharded it: each box held a small fraction of the model's layers under pipeline parallelism, passing activations between boxes to complete each forward pass.

The cluster served the model at 0.39 tokens per second — slow enough that a full response would take hours, but functional. That's the point. A distributed botnet of cheap IoT devices could pool enough compute to run a genuinely capable model, with each infected device contributing a shard. As a reference for scale, the authors point to Kimwolf, a real IoT botnet that infected over two million devices, primarily off-brand Android TVs. At that fleet size, groups of 15 TVs could host on the order of 133,000 concurrent copies of a 26B model — a tiny amount of compute by datacenter standards, but enough for slow, patient replication.

Can small models actually drive a replication chain?

The team decomposed autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. They mostly skipped the first two — earlier work they cite (CyberGym, ExploitBench, and research on adaptive worms) already shows small models can handle cyber exploits when given tools. The least-studied stage, and their focus, is inference setup: getting a model server running on hardware you've never seen, which means picking a compatible stack, finding the right package versions, and debugging machine-specific failures in a long chain of serial steps.

The results came in three tiers:

• Inference setup on unfamiliar hardware: largely solved. A 9-billion-parameter model (Qwen3.5-9B) got inference running on 8 of 9 hardware types tested, from a Jetson Nano to Macs and RTX 4090s. More capable models were both more reliable and faster.
• Full end-to-end replication: one model passed. In a firewalled test network of 8 cloud machines running an Android emulator, with the worm hopping node to node, only GLM-5.2 (an open-weight model from China's Z.ai) completed the entire cycle — spreading to 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. Crucially, the test made the hacking step trivially easy via unauthenticated debug ports, which the authors themselves flag as an upper bound on real-world success.
• Today's small models compose steps badly. Models of 30B parameters and under can complete many individual steps but make mistakes chaining them end to end. Extrapolating the historical improvement rate of small open models (about 13.7 points per year on Epoch AI's Capabilities Index, R² 0.95), the trendline puts a small model at GLM-5.2's capability level by the end of 2026 — hence "months away," a projection, not a fact.

Why an AI worm would be a genuinely new kind of malware

Traditional botnets like Mirai spread by trying default usernames and passwords against known device types — dumb but effective. An AI replicator differs in three ways the paper lays out:

• It can handle novelty. Because a model rides along with the payload, the worm can attempt to set itself up on hardware its author never anticipated — a Jetson Nano one day, a smart oven the next — instead of only targeting one device family.
• It may not need root. Inference engines run fine in userspace, and the poorly secured devices in this threat model can simply be re-infected after a restart. Existing botnets like P2Pinfect and Fritzfrog already operate without privilege escalation.
• It can learn as it spreads. Daughter copies inherit the parent's notes and code. In the team's multi-generation test, Qwen3.5-9B's inference-setup success rate rose from 45% in the first generation to between 61% and 84% in later ones as lineages passed down what they'd learned.

The spread itself would be slow — the authors describe doubling times on the order of days, with each replication taking one to two days of inference time on weak hardware. One tested worry came back negative: giving small models access to a stronger "advisor" model didn't measurably help, because small models don't know the right questions to ask. The team's darker guess is that coordination, if it comes, will look like a large model handling strategy and spawning small models as subagents.

The honest caveats — and the ones the authors want you to keep

This is the part to remember before sharing a scary headline. Anthropic's own write-up, and the independent coverage of it, stress that:

• The cyber step was deliberately trivial. The replication test used emulated Android nodes with unauthenticated debug ports, and the worm's own model ran on a separate server. Real-world attackers would face authentication, patching, and network segmentation the eval didn't model. The authors also note real IoT security has sometimes been nearly this bad — Mirai spread largely via factory-default passwords — but "sometimes" is doing real work in that sentence.
• There is no wild sighting. Nobody has observed an AI worm replicating on consumer devices. The study is a capability floor measurement, and its timeline is an extrapolation from a benchmark curve (Epoch's ECI), which the authors call a rough proxy for replication ability.
• Scale estimates anchor on one botnet. The 133,000-copies figure assumes Kimwolf's two-million-device fleet could be repurposed and every 15 boxes served one model copy. It's an illustrative calculation, not a forecast.

What defenders can actually do

The paper closes with blue-team advice, and its logic is epidemiological: drive the reproduction number below 1 so the replicator dies out instead of going endemic. Three practical layers:

• Watch for the network signature. A weight-based replicator leaves traces — multi-gigabyte model payloads moving to ordinary consumer devices, sustained device-to-device traffic between machines that never normally talk, and scanning patterns. There's a trade-off the defenders win either way: faster replication means louder traffic. Once discovered, honeypots can capture the worm's harness for analysis.
• Quarantine like it's 2017. When ISPs used infection evidence to quarantine and notify customers during the Mirai cleanup, restricting infected networks to a short whitelist of sites cleared 92% of infections within 14 days (versus 74% without notification). The same playbook applies here; full eradication is harder because it requires coordinating every affected ISP.
• Shrink the target pool at the source. The UK already made default IoT passwords non-compliant by law — the kind of secure-by-default regulation that removes the easiest infections for AI and classic botnets alike. For device owners, the current best moves are unglamorous: update firmware, change default credentials, and remember that a $55 TV box is a computer on your network.

One-line takeaway: the ingredients for slow, self-replicating AI malware on cheap devices now mostly exist in lab conditions, and the gap that remains is composed model-building rather than exotic capability — which is exactly why the defensive boring work (patching, monitoring, secure defaults) is worth doing this quarter, not after a headline.

Prices and benchmark figures are standard published rates as of October 13, 2026 and can change without notice. Some outbound links may be affiliate links — see our disclosure. Found an error? Tell us and we'll correct it in public.