Anthropic Warns of AI Worms Spreading on Smart Devices

Anthropic’s Frontier Red Team says small open models can already handle the hardest step for a self-spreading AI: getting themselves running on an unfamiliar device. Nothing like this has been found in the wild, and the tests relied on shortcuts. Anthropic still expects small models to close the remaining gap within months.

Anthropic’s Frontier Red Team thinks small AI models could soon spread themselves across smart TVs, ovens and other cheap connected devices without any help from a datacenter. Researchers William Zhou and Daniel Freeman published the findings Monday in a research post. They wrote that such models “may be months away” from being able to self-replicate on consumer IoT hardware.

A worm is a program that copies itself from machine to machine with no person directing it. Earlier academic work had already shown AI agents doing this inside a GPU cluster. Anthropic wanted to know whether it could happen on hardware that costs almost nothing and that hardly anyone secures.

The team bought 15 off-brand Android TV boxes at roughly $55 apiece, each with 4GB of memory, and wired them together. They split Google’s Gemma4-26B-A4B across the boxes, two layers per box, and the cluster produced 0.39 tokens per second. Nobody would chat with a model that slow, but a worm has no user waiting on it.

How the worm test worked

Anthropic breaks replication into four steps. A worm has to find a target, get in, get a model running on the new device and then start over from there. The team spent little time on breaking in. It pointed to earlier benchmarks such as CyberGym showing small models can already handle basic exploits. Most of the work went into setting up a running model on each new device, which the authors call the least studied part of the chain.

Small models did better at this than many would expect. Qwen3.5-9B got an inference server running on 8 of the 9 hardware types tested, from Nvidia Jetson Nanos to Macs. That flexibility sets an AI worm apart from older botnets, which are written for one kind of device. Kimwolf, which Synthient reported had infected more than two million machines at its peak, targeted Android TVs and mobile devices. An AI worm can figure out each new machine when it lands on it.

The full test ran on a firewalled network of eight emulated Android devices in Google Cloud. Anthropic planted a worm on one node and let it run. Of the open-weight models tested, only the Chinese model GLM-5.2 made it all the way through. It reached all eight nodes in four of five runs and seven nodes in the fifth. The other models failed every time.

The copies also improved as they spread. In a separate test, each instance of Qwen3.5-9B left notes for the next one. Their success rate at getting a model running rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model Anthropic’s own Opus 4.8 as an adviser made no measurable difference. According to the researchers, the small model didn’t know what to ask.

Slow to spread, hard to stop

Anthropic used Kimwolf as a yardstick for scale. Picture an AI worm infecting a fleet that size and running the 26B model on groups of 15 boxes. Based on public H100 benchmarks, the whole fleet would have about as much computing power as 40 Nvidia H100s. Large cloud providers buy GPUs by the hundred thousand. Spreading would also take time. Anthropic estimates 28 to 51 hours to get a 9B model running on each new device and 71 to 150 hours for the 26B model.

What concerns the authors is how hard such a worm would be to remove. Spread across millions of home and office gadgets, it would have no server, account or company anyone could shut down. The authors compare it to a slime mold.

The number of possible hosts is also growing. Security cameras and video-conferencing systems increasingly ship with their own AI chips. Anthropic estimates about 9.5 million devices with Nvidia chips are in use, though it says most can’t be reached directly from the internet.

On timing, the team charted open models with 30 billion parameters or fewer against the Epoch Capabilities Index, a general score of model ability. If the trend holds, a small model will match GLM-5.2 by the end of 2026.

What the tests left out

Anthropic is clear about its shortcuts. The worm got into each node through a debugging port with no password. The authors treat their results as a best case for the attacker. They also point out that Mirai, the botnet behind the 2016 attack that knocked major websites offline, spread by trying factory-default passwords. Real devices may not be much harder to get into.

The end-to-end test also didn’t run on the TV boxes. GLM-5.2 itself ran on a separate server, and its job was to install the much smaller Llama3.1-8B on each node. That shows a model as capable as GLM-5.2 can spread a small model. No model small enough to fit on a TV box has done it yet. The year-end projection rests on a general capability score, which the authors describe as only a rough stand-in for replication ability.

Skeptics raise other objections. Ordinary malware has exploited cheap, unpatched IoT gear for years without any AI. The Vo1d botnet alone took over about 1.6 million Android TV boxes. Some analysts have also dismissed Anthropic’s earlier security warnings, particularly about its Mythos model, as “criti-hype”.

Our read

It would be easy to dismiss the report because of the 40-H100 figure. The more important finding is that small models anyone can download can already handle the hardest part of spreading: getting themselves running somewhere new. They can’t yet do it reliably. Anthropic expects that to change within months, and its own data shows copies getting better as they pass notes along.

For enterprise security teams, this is a category most AI policies don’t cover. Current programs mostly govern what employees type into chatbots and what agents are allowed to touch. We’ve written about why agents shouldn’t inherit their human operators’ permissions, and why Satya Nadella says companies should treat AI models like insider threats. Anthropic’s report is about AI that nobody at the company deployed, running on the lobby display, the conference-room camera or a storage box in a branch office.

Defenders do have some advantages. A worm moving multi-gigabyte model files around would be noisy. Devices that rarely talk to each other would suddenly be exchanging steady traffic, and the faster the worm spread, the easier it would be to spot.

There’s precedent for cleanup, too. One internet provider quarantined its Mirai-infected customers and told them how to fix their devices. In that case, 92% of infections cleared within 14 days, compared with 74% for customers who weren’t notified. The UK has also banned default passwords on new connected devices. But all of this only works if someone is watching network traffic and counts cheap devices as part of the network.

What to watch

Outside replication comes first. These results come from one lab’s experiments on a network it built. Independent researchers running similar tests on real hardware, with passwords turned on, would show how much the shortcuts helped.

Next are new small open models. Anthropic has set the bar at GLM-5.2’s level of ability in a model of 30 billion parameters or fewer. Each new release in that size range will show whether its projection holds.

Last is the first case found outside a lab. Anthropic expects it to look less like a sudden attack and more like an ordinary botnet that installs AI models where it once would have installed crypto miners.