Small enough to spread.

A worm with a model inside

On Oct. 12, Anthropic's Frontier Red Team published a study warning that small AI models may be months away from being capable enough to copy themselves onto commercial internet-connected devices. The study means smart TVs, set-top boxes and similar gadgets, outside any data center.

The researchers call the behavior autonomous replication: a model deploying and propagating itself without human control. Computer worms, programs that copy themselves from machine to machine, are an old idea. What's new is a worm that carries an AI model, which can, in principle, decide what to do next on each machine it reaches.

It reports signs of life for AI worms and no working one yet. No current model is both small enough to fit on cheap devices and capable enough to copy itself reliably. The authors expect that to change, and the clearest part of their evidence is a test with 15 off-brand TV boxes.

What a copy needs

For a model to copy itself, it has to move its weights to a new machine and get the model running there, with no person helping. The red team splits the job into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host.

The study concentrates on the third stage. Breaking into devices, the first two stages, is old territory for cybersecurity, and the researchers deliberately kept it simple. The open question is whether a model can set itself up on a weak, unfamiliar machine.

That sets two limits. A model must sit under a size ceiling, small enough to fit on the devices it lands on. It must also sit above a capabilities floor, smart enough to finish the job reliably. In the authors' words, right now the floor and ceiling don't intersect.

This is about open-weight models, whose weights anyone can download. The study distinguishes them from frontier models whose weights stay with their lab: a closed model that tried to replicate would be running on its lab's own infrastructure, while an open-weight replicator would start with fewer resources but unmonitored.

It reports signs of life for AI worms and no working one yet.

Fifteen TV boxes

The team bought 15 inexpensive off-brand Android TV boxes, at about $55 each, with 4 GB of memory apiece. Then it ran Gemma4-26B-A4B, a model too big for any one box (models that size need 10 or more 4 GB machines), split across all 15 so that each box held a small fraction of the model's layers. It worked. It produced 0.39 tokens per second, a slow trickle of text.

A smaller model, with nine billion parameters, got inference running on eight of the nine hardware types the team tested. Setting up inference took one such model, Qwen3.5-9B, 28 to 51 hours; the larger Gemma model took 71 to 150 hours.

The team then tested the whole cycle on a sealed network of eight cloud machines running an Android emulator, software that imitates an Android device. The worm moved between them over an unauthenticated ADB port. Of the open-weight models tested, only GLM-5.2 managed full end-to-end replication: it spread to all eight nodes in four of five trials, and to seven in the fifth.

Two more results point the same way. With the setup step handled by a pre-written script, even a three-billion-parameter model reached about half the nodes of a 17-node network. And when each new copy of Qwen3.5-9B inherited short notes from the last one on what it had tried, the share that got inference working rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model a stronger frontier model as an adviser didn't measurably help.

Why the numbers come with an asterisk

The researchers flag the soft spot in their own test. The break-in step was deliberately trivial, an open debugging port with no password, so they call the result an upper bound on real-world success. They also point out that past device botnets, networks of hijacked machines, spread through means as simple as going through a default list of manufacturer usernames and passwords. Real-world defenses may not be much harder than their test.

The forecast comes from a trend line. The team tracked open-weight models with 30 billion parameters or fewer on the Epoch Capabilities Index, a composite score of model ability, and found a gain of 13.7 points a year. Extended forward, the line puts a small model at GLM-5.2's level by the end of 2026. The authors caution that the index is only a rough proxy for replication ability.

The authors note that one botnet, Kimwolf, infected over two million devices, mostly off-brand Android TVs. By their rough estimate, a fleet like that could host about 133,000 copies, together producing around 80,000 tokens per second. And a replicator spread across that many homes would be challenging to shut down, since there's no central point to switch off.

Home gadgets are the likely first targets. The authors said, according to Al Jazeera, that such devices are connected to the internet and have historically had minimal security. Roman Yampolskiy, an AI and cybersecurity researcher at the University of Louisville, told the outlet that an AI worm could reason about unfamiliar devices, something traditional malware cannot. "Today, this is not an existential threat," he said. "But the trajectory is concerning."

The authors offer their own comparison: like coding agents in 2024, they see signs of life for AI worms. The study makes no claim that worms will follow the same path. The comparison explains why a red team would publish a warning while its own test still fails on real devices.

What people get wrong

"This is about a frontier model escaping its lab." The study is mostly about small open-weight models anyone can download, running on hardware no lab watches. A closed frontier model would be replicating on its own lab's infrastructure, which is a different problem.

"AI worms are already loose." The authors write that they don't yet have a full rogue replicator. Their tests ran on networks they built, with the break-in made easy on purpose.

"The model would have to be brilliant." It wouldn't. It has to be good enough to set itself up on a new machine, a narrow skill, and the scripted test showed a three-billion-parameter model reaching about half the nodes once that step was done for it.

"Turn off the server and it stops." There is no server. A spread-out replicator has no single point to shut off. It may also be slow, with a doubling time of days, which is what gives defenders their opening.

What to watch, what to do

The defense the authors describe borrows from epidemiology: push the replicator's R₀ below one, so that it dies out instead of staying endemic. They point to three tools: internet providers spotting a worm's traffic pattern in their network monitoring, decoy devices called honeypots that catch a sample to study, and quarantine. With the Mirai botnet, quarantining infected subscribers and telling them cleared 92% of infections within 14 days, against 74% with no notification.

The other lever is the devices. The authors call for more secure defaults from manufacturers and note that default passwords are now non-compliant in UK markets. Under UK rules that took effect on April 29, 2024, a connected product's password must be unique or set by the user, and the maker must publish how long it will get security updates.

For anyone with a house full of gadgets, the standard advice applies. The UK's National Cyber Security Centre says to change a device's default password, turn on automatic updates, avoid devices whose support period has ended or will end soon, and switch off remote access if you only use a device on your home Wi-Fi. Kimwolf's two million devices were mostly off-brand Android TVs, the same kind of box the red team bought.