Anthropic's AI-worm study: small models could soon spread across cheap smart-TV boxes. What IT teams should check

Anthropic’s Frontier Red Team has published a study arguing that small, open-weight AI models may be months away from being able to copy themselves across cheap internet-connected devices, with no datacenter involved. The post, AI models may be capable of self-replicating without access to a datacenter, went up on 12 October and was reported the next day as a warning about smart TVs and fridges.

The headline is dramatic, but the paper itself is careful, and most of it is useful to the people who run networks rather than the people who build models. Here is what was actually tested, what it does and doesn’t show, and what an IT or security team can do with it.

What “self-replication” means here

The authors, William Zhou and Daniel Freeman, study what they call autonomous replication and adaptation. Their concern is a “weight-based replicator”: a worm that carries or downloads a model’s weights and runs that model on the hardware it has taken over, so the AI itself decides how to spread next.

They split the job into four stages: finding targets, getting code to run on them, setting up inference (getting the model to actually run on unfamiliar hardware), and continuing to spread. They largely set aside the hacking stages, citing earlier work, and focus on the step that was previously assumed to be the barrier: can a small model get itself running on cheap, odd hardware without help?

What they found

The answers, from the Anthropic post:

Cheap hardware is enough to run a capable model, slowly. As a demonstration, they split Gemma4-26B-A4B across 15 off-brand Android TV boxes, about $55 each with 4GB of RAM, and got it running at 0.39 tokens per second.
Small models can do the steps, but struggle to chain them. Models of 30B parameters or fewer completed many individual setup steps but had trouble stringing them together. Qwen3.5-9B could set up inference across a range of hardware; GLM-5.2 was more reliable and faster.
One open-weight model completed the whole chain. In a firewalled test network of eight cloud nodes running an Android emulator with an unauthenticated debugging port, GLM-5.2 spread to all eight nodes in four of five trials and to seven in the fifth.
Notes left behind help. When each generation of Qwen3.5-9B inherited notes from the one before, setup success rose from 45% to between 61% and 84% in later generations.
Frontier advice didn’t help. Giving the small model access to a frontier model (Opus 4.8) as an advisor produced no significant improvement.

The forecast that drew the headlines comes from a trend line. Fitting a capability index for models of 30B parameters or fewer, the authors see a gain of about 13.7 points a year and estimate that a small model would reach GLM-5.2’s level by the end of 2026. In their framing, these are “signs of life for AI worms”.

What it doesn’t show

The authors list the limits themselves, and they matter:

The break-in was made easy on purpose. The test network left the Android debug port open with no authentication, so the end-to-end results are an upper bound, not a forecast of real-world success.
It is slow. Their estimates put full setup at roughly 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B on this class of hardware. They describe the spread as having a doubling time of days, not minutes.
The trend line is a rough proxy. The capability index measures general ability, not replication ability specifically, and the speed estimates rest on one hardware class and one historical botnet.
Social engineering stays hard. Small models scored poorly on a spearphishing benchmark, so the authors expect that kind of attack to remain a job for large models.

So this is not evidence of an AI worm in the wild. It is a measured claim that one of the assumed barriers, getting a model running on junk hardware, is falling faster than expected.

Why it is different from an ordinary botnet

The part worth pausing on is adaptation. A conventional botnet spreads with fixed code written for known device types. The paper’s point is that a model-driven replicator could work out unfamiliar devices on its own and learn from what earlier copies wrote down. The authors also note that with no central host, such a replicator would be challenging to shut down.

Scale is the counterweight. Their back-of-envelope swarm, sized like a past botnet of over 2 million devices, works out to roughly the compute of 40 H100 GPUs. That is not much intelligence spread across a lot of devices.

What IT and security teams can do now

The paper’s own blue-team section is practical. Its central idea is to push the replicator’s effective spread rate below one, so each infection causes less than one new one. In plain terms for an office, a co-working space or an ISP:

Inventory the cheap stuff. Off-brand Android TV boxes and smart appliances were the paper’s model target; meeting-room displays and cheap cameras belong in the same bucket. List what is on your network and who owns it.
Close remote debugging and default credentials. The test relied on an open, unauthenticated debug interface. Make sure developer and debug services are off on anything that doesn’t need them, and change factory passwords. The paper points to the UK’s ban on default IoT passwords as the kind of secure-by-default rule that shrinks the pool of targets.
Segment. Put IoT devices on their own network with no route to servers, laptops or each other unless needed. Device-to-device traffic is one of the signals the authors suggest watching.
Watch for big, odd transfers. A weight-based replicator has to move model weights. The paper suggests looking for anomalous multi-gigabyte transfers in flow data, especially to or from devices that normally send little.
Notify, don’t just block. For ISPs and large networks, the paper cites Mirai-era data: quarantining infected subscribers and telling them cleared 92% of infections within 14 days, against 74% without notification.

None of this is new advice. What the paper adds is a reason to stop treating the forgotten TV box in the meeting room as harmless.

For people building with small models

If you ship on-device or edge AI, this study is a reminder that the same efficiency gains that make local models attractive also lower the bar for misuse. The authors don’t give developer-specific rules, but the general direction is clear: don’t ship devices with open debug services or default credentials, and assume that a capable small model can figure out hardware you didn’t design it for.

The authors frame their results as early signs, not an incident. Given the timeline they project, the cheapest defence, basic IoT hygiene, is worth doing this quarter.