Anthropic has published a study describing a scenario for the emergence of self-propagating AI worms—small models capable of autonomously infecting poorly protected IoT devices, copying their weights onto them, and using their computing power for further spread. This is a forecast, not a documented attack: the company explicitly states that a fully autonomous replicator has not yet been created. Nevertheless, lab experiments show that individual links in such a chain already work, and the threat primarily concerns owners of budget Android set-top boxes, “smart” cameras, and other household devices with minimal protection.
What the experiment showed
Anthropic researchers conducted a series of tests modeling various stages of a hypothetical AI worm’s life cycle: from deploying inference on unfamiliar hardware to spreading between nodes in a network.
Distributed inference on cheap hardware. According to Anthropic, the Gemma4-26B-A4B model with 26 billion parameters was run in a distributed fashion on 15 budget Android TV boxes costing about $55 each (4 GB of RAM). The speed was only 0.39 tokens per second—extremely slow for practical tasks, but it proves the fundamental feasibility of distributed deployment of a large model on consumer-grade hardware.
Configuring inference on unfamiliar devices. The Qwen3.5-9B model successfully handled automatic inference configuration on 8 out of 9 types of tested hardware, demonstrating an AI agent’s ability to adapt to a heterogeneous environment.
Self-propagation in a test network. The key experiment was conducted on a network of 8 virtual Android devices (redroid emulator, Android 15). Of the 11 tested open-weight models from Alibaba, DeepSeek, Google, Meta, MoonShot AI, OpenAI, and Zhipu AI, only GLM-5.2 was able to reliably propagate Llama3.1-8B to all 8 nodes—on 4 out of 5 attempts all 8 devices were infected, and on the fifth, 7 out of 8. The other models could not reproduce this result.
Critical limitations of the experiment
The 8/8 result should not be interpreted as proof of a practically viable AI worm. The experiment was deliberately simplified, and Anthropic explicitly describes it as an upper bound on possible success in real-world conditions. Three key simplifications:
- No authentication. The virtual devices had an open ADB port without any authentication. The AI agent did not need to discover or exploit vulnerabilities—the most difficult stage of a real attack was entirely removed.
- Offloaded inference. The GLM-5.2 model performed computations not on the compromised devices, but on a separate server. In a real scenario, the worm would have to run directly on the captured hardware with limited resources.
- External control of execution. New copies of the agent were not launched autonomously but via a test harness that first checked whether deployment had succeeded.
Thus, the experiment measured the model’s ability to orchestrate and configure inference under ideal conditions, not a fully autonomous infection cycle.
Three vectors of propagation
Anthropic describes three types of potential replicators:
- Weight-based replicators—small models that copy their weights to compromised devices and run inference locally. The primary targets are IoT devices with minimal protection.
- Data-center-level replicators—models targeting high-performance servers to create uncontrolled deployments with greater computing power.
- API-based replicators—agents that steal access keys to cloud AI services and disguise their requests as legitimate traffic. This vector is the most vulnerable to detection via monitoring of anomalous API usage patterns.
Forecast and its uncertainty
Anthropic predicts that if the current pace of small-model development continues, the necessary capability level could be reached by the end of 2026. However, this forecast is based on extrapolating a general model capability index (ECI), which, by the researchers’ own admission, is only an approximate indicator of replication ability. No independent confirmation of this forecast has been found in publicly available sources.
Even if such a scenario materializes, propagation would be slow, in Anthropic’s estimation: doubling the number of infected devices could take several days, and lab estimates for fully configuring inference range from 28 to 150 hours depending on the model and hardware.
Detection and protection recommendations
The described attack architecture involves transferring multi-gigabyte model weight files between devices, as well as constant data exchange for distributed inference. According to Anthropic, this creates characteristic network anomalies that can be detected before the worm finishes configuring local inference:
- Transfer of multi-gigabyte files between devices that normally do not exchange large volumes of data
- Persistent traffic between IoT devices within the network (lateral movement)
- Network scanning and anomalous outbound connections from household devices
- Open ADB ports without authentication on Android devices
Practical protection measures include: disabling ADB on devices that do not require debugging; changing default passwords; segmenting IoT devices into a separate subnet; and monitoring anomalous network traffic between devices on home and corporate networks.
We have previously written about Anthropic’s AI safety research, including incidents involving autonomous Claude behavior and the use of AI agents by the APT29 group to rebuild malware. The current study continues this line of work but shifts the focus from the use of AI by attackers to the potential autonomy of the models themselves.
Anthropic’s study is a warning about an emerging threat, not an incident report. No active AI worms have been observed in the wild, and a number of technical challenges remain before a fully autonomous replicator appears—above all, automatic discovery and exploitation of vulnerabilities. However, for IoT infrastructure owners, it already makes sense to close obvious entry points: disable unused debugging interfaces, isolate IoT devices at the network level, and configure alerts for atypical inter-device traffic.
