The record for this issue
Small enough to spread.
115 claims in the draft, each tested by a second agent against the page it cites. 108 held; 7 did not and were fixed or cut before this went out.
-
01
titleconfirmed
Small enough to spread. (framing: small models spreading)
The page says “small AI models may be months away from being capable enough”
-
02
dekconfirmed
Published/ran on Oct. 12 by Anthropic's red team
The page says “Published Oct 12, 2026 by the Frontier Red Team (William Zhou, Daniel Freeman)”
-
03
dekconfirmed
AI model run on 15 cheap TV boxes
The page says “We run Gemma4-26B-A4B, distributed over 15 inexpensive off-brand Android TV boxes (~$55 each)”
-
04
dekconfirmed
watched another [model] copy itself across a test network
The page says “it spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1”
-
05
dekconfirmed
No small model can do it reliably yet
The page says “Right now, the floor and ceiling don't intersect”
-
06
summaryconfirmed
red team's result is an upper bound
The page says “which makes this an upper bound on real-world success”
-
07
summaryconfirmed
copy onto cheap home devices; what slows a worm down (defenses)
The page says “defense aims to push R0 below 1 ... quarantine and notify customers”
- 08 confirmed
-
09
The essay, section 1confirmed
On Oct. 12, Anthropic's Frontier Red Team published a study
The page says “Published Oct 12, 2026 by the Frontier Red Team”
-
10
The essay, section 1confirmed
small AI models may be months away from being capable enough to copy themselves onto commercial internet-connected devices
The page says “small AI models may be months away from being capable enough ... to self-replicate on commercial internet-of-things (IoT) devices”
-
11
The essay, section 1confirmed
smart TVs, set-top boxes and other gadgets, not data centers
The page says “Such smart TV boxes, which are readily available for purchase; title: '...without access to a datacenter' (Al Jazeera: 'smart TVs, fridges, ovens and lawnmowers')”
-
12
The essay, section 1confirmed
autonomous replication defined as a model deploying and propagating itself without human control
The page says “which involves a model deploying and propagating itself without human control”
-
13
The essay, section 1confirmed
worm carrying an AI model can decide what to do next on each machine
The page says “reason about unfamiliar devices, adapt when its approach fails, and continue spreading without a human operator”
-
14
The essay, section 1confirmed
signs of life for AI worms, not a working one
The page says “we're seeing signs of life for AI worms ... We don't yet have a full rogue replicator”
-
15
The essay, section 1confirmed
No current model both small enough and capable enough to copy itself reliably
The page says “Right now, the floor and ceiling don't intersect”
-
16
The essay, section 1confirmed
authors expect that to change
The page says “the trend line puts a small model at that level by the end of 2026”
-
17
The essay, section 1confirmed
15 off-brand TV boxes
The page says “15 inexpensive off-brand Android TV boxes”
-
18
The essay, section 2unsupported
weights are a large file of numbers learned in training; running the model is inference (definitions)
-
19
The essay, section 2confirmed
four stages: finding targets, gaining execution, establishing inference, continuing propagation from the new host
The page says “finding targets, gaining execution, establishing inference, and continuing propagation from the new host”
-
20
The essay, section 2confirmed
study concentrates on the third stage (inference)
The page says “setting up inference on compromised devices, which is our focus here”
-
21
The essay, section 2confirmed
break-in is old territory for cybersecurity; researchers kept it simple
The page says “earlier work already show[s] that small models are capable of cyber exploits ... keeps the cyber-exploit element of the replication trivial”
-
22
The essay, section 2confirmed
size ceiling the model must sit under
The page says “A model size ceiling that the model must sit under”
-
23
The essay, section 2confirmed
capabilities floor the model must sit above
The page says “A model capabilities floor that an autonomous worm must sit above”
-
24
The essay, section 2confirmed
'the floor and ceiling don't intersect' (authors' words)
The page says “Right now, the floor and ceiling don't intersect”
-
25
The essay, section 2confirmed
closed model replicating would run on its lab's own infrastructure
The page says “Large closed-weight replicators run on their lab's infrastructure”
-
26
The essay, section 2confirmed
open-weight replicator starts with fewer resources but unmonitored
The page says “start off relatively lower-resourced (due to not benefitting from a lab's compute), but start unmonitored”
-
27
The essay, section 2confirmed
'4 GB EACH'
The page says “15 smart TV boxes with 4GB of RAM each”
-
28
The essay, section 2confirmed
A 26-billion-parameter model needs 10 or more 4 GB boxes
The page says “inference of 26B models with 10+ machines”
-
29
The essay, section 2confirmed
Split so each holds a few of its layers, it runs, slowly
The page says “pipeline parallelism, each box holding a small fraction of the layers; 0.39 tokens per second”
-
30
The essay, section 2confirmed
five slices each into own box (illustration of layer split)
The page says “each box holding a small fraction of the layers”
-
31
The essay, section 3confirmed
15 inexpensive off-brand Android TV boxes
The page says “15 inexpensive off-brand Android TV boxes”
- 32 confirmed
-
33
The essay, section 3confirmed
4 GB of memory apiece
The page says “15 smart TV boxes with 4GB of RAM each”
-
34
The essay, section 3confirmed
ran Gemma4-26B-A4B split across all 15
The page says “We run Gemma4-26B-A4B, distributed over 15 ... boxes”
- 35 unsupported
-
36
The essay, section 3confirmed
models that size need 10 or more 4 GB machines
The page says “inference of 26B models with 10+ machines”
-
37
The essay, section 3confirmed
each box held a small fraction of the layers
The page says “each box holding a small fraction of the layers”
-
38
The essay, section 3confirmed
0.39 tokens per second
The page says “Gemma4-26B-A4B ... at 0.39 tokens per second (intro; a later section cites ~0.3 tok/s)”
-
39
The essay, section 3unsupported
a token is a word or part of a word; roughly one word every few seconds
-
40
The essay, section 3confirmed
nine-billion-parameter model got inference running on eight of nine hardware types
The page says “a 9B model got inference running on 8 of the 9 hardware types we tested”
-
41
The essay, section 3confirmed
Qwen3.5-9B took 28 to 51 hours to set up inference
The page says “Qwen3.5-9B full inference setup time is 28-51 hours”
-
42
The essay, section 3confirmed
Gemma took 71 to 150 hours
The page says “Gemma4-26B-A4B (unoptimized) 71-150 hours”
-
43
The essay, section 3unsupported
'A worm doesn't need to be quick if nobody notices it.' (also the pull_quote)
-
44
The essay, section 3confirmed
sealed network of eight cloud machines running an Android emulator
The page says “we built a firewalled VPC of 8 GCP nodes running redroid, an Android 15 emulator”
-
45
The essay, section 3confirmed
spread over an unauthenticated ADB port
The page says “over an unauthenticated ADB port”
-
46
The essay, section 3unsupported
ADB is a debugging connection that lets one machine run commands on another
-
47
The essay, section 3confirmed
only GLM-5.2 of the open-weight models managed full end-to-end replication
The page says “Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication”
-
48
The essay, section 3confirmed
all eight nodes in four of five trials, seven in the fifth
The page says “it spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1”
-
49
The essay, section 3confirmed
with scripted setup a 3B model reached about half the nodes of a 17-node network
The page says “even a 3B model reaches about half the nodes (17-node experiment, inference setup scripted)”
-
50
The essay, section 3confirmed
Qwen3.5-9B notes: 45% first generation
The page says “It rises from 45% in the first generation”
-
51
The essay, section 3confirmed
61% to 84% in later generations
The page says “to between 61% and 84% in later ones”
-
52
The essay, section 3confirmed
frontier adviser didn't measurably help
The page says “The frontier model's advice doesn't measurably help”
-
53
The essay, section 3confirmed
Qwen3.5-9B share of attempts that got inference running, by generation
The page says “Passing notes between generations of Qwen3.5-9B raised inference setup success”
-
54
The essay, section 3confirmed
First generation 45%
The page says “45% in the first generation”
-
55
The essay, section 3confirmed
Later, lowest 61%
The page says “between 61% and 84% in later ones”
-
56
The essay, section 3confirmed
Later, highest 84%
The page says “between 61% and 84% in later ones”
-
57
The essay, section 3confirmed
notes lifted success; frontier adviser didn't
The page says “The frontier model's advice doesn't measurably help”
-
58
The essay, section 4confirmed
break-in step deliberately trivial, open debugging port with no password
The page says “keeps the cyber-exploit element of the replication trivial ... no authentication over the ADB port”
-
59
The essay, section 4confirmed
they call the result an upper bound on real-world success
The page says “which makes this an upper bound on real-world success”
-
60
The essay, section 4confirmed
past botnets spread via default manufacturer usernames and passwords
The page says “past IoT botnets have replicated via means as simple as going through a default list of manufacturer usernames and passwords”
-
61
The essay, section 4confirmed
Real-world defenses may not be much harder than their test
The page says “past IoT botnets have replicated via means as simple as ... default list (writer's inference from this passage; reasonable)”
-
62
The essay, section 4confirmed
tracked open-weight models with 30B parameters or fewer
The page says “notable open-weight models of 30B total parameters or fewer”
-
63
The essay, section 4confirmed
Epoch Capabilities Index, a composite score of model ability
The page says “Epoch Capabilities Index ... ECI is a general capability index”
-
64
The essay, section 4confirmed
gain of 13.7 points a year
The page says “with a gain of 13.7 ECI per year (page says 'ECI', not 'points'; equivalent)”
-
65
The essay, section 4confirmed
line puts a small model at GLM-5.2's level by end of 2026
The page says “If we take GLM-5.2 as a capabilities floor for replication, the trend line puts a small model at that level by the end of 2026”
-
66
The essay, section 4confirmed
index is only a rough proxy for replication ability
The page says “ECI is a general capability index, which is only a proxy metric for replication ability”
-
67
The essay, section 4confirmed
Kimwolf infected over two million devices, mostly off-brand Android TVs
The page says “a large IoT botnet that infected over two million devices, primarily off-brand Android TVs”
-
68
The essay, section 4confirmed
rough estimate ~133,000 copies
The page says “we would have ~133k copies ... a rough estimate”
-
69
The essay, section 4confirmed
around 80,000 tokens per second together
The page says “yielding 80k tokens/s across the botnet”
-
70
The essay, section 4confirmed
challenging to shut down, no central point to switch off
The page says “would be challenging to shut down, since there's no centralized point to shut off”
-
71
The essay, section 4unsupported
'The authors told Al Jazeera' that devices are connected and have had minimal security
-
72
The essay, section 4confirmed
Roman Yampolskiy, AI and cybersecurity researcher at the University of Louisville
The page says “an AI and cybersecurity expert at the University of Louisville”
-
73
The essay, section 4confirmed
Yampolskiy told the outlet
The page says “Yampolskiy told Al Jazeera”
-
74
The essay, section 4confirmed
AI worm could reason about unfamiliar devices, unlike traditional malware
The page says “reason about unfamiliar devices, adapt when its approach fails, and continue spreading without a human operator”
-
75
The essay, section 4confirmed
quote: "Today, this is not an existential threat" (7 words, attributed)
The page says “"Today, this is not an existential threat. But the trajectory is concerning," Yampolskiy said”
-
76
The essay, section 4confirmed
quote: "But the trajectory is concerning." (5 words, attributed)
The page says “But the trajectory is concerning”
-
77
The essay, section 4confirmed
like coding agents in 2024, signs of life for AI worms
The page says “Like coding agents in 2024, we're seeing signs of life for AI worms”
-
78
The essay, section 4confirmed
study doesn't claim worms will follow the same path
The page says “Page offers the comparison only; 'We don't yet have a full rogue replicator'”
-
79
The essay, section 4confirmed
April 29, 2024: UK rules against default device passwords take effect
The page says “came into effect on 29 April 2024 ... Passwords must be unique per product; or capable of being defined by the user”
-
80
The essay, section 4confirmed
Oct. 12, 2026: Anthropic: no small model can yet replicate reliably
The page says “Published Oct 12, 2026 ... Right now, the floor and ceiling don't intersect”
-
81
The essay, section 4confirmed
End of 2026: trend line puts a small model at GLM-5.2's level
The page says “the trend line puts a small model at that level by the end of 2026”
-
82
The essay, section 4confirmed
dates from the study and the UK rules
The page says “came into effect on 29 April 2024”
-
83
The essay, section 5confirmed
study mostly about small open-weight models; closed frontier model would replicate on its lab's infrastructure
The page says “Large closed-weight replicators run on their lab's infrastructure ... start unmonitored”
-
84
The essay, section 5confirmed
authors write they don't yet have a full rogue replicator
The page says “We don't yet have a full rogue replicator”
-
85
The essay, section 5confirmed
tests ran on networks they built, break-in made easy on purpose
The page says “firewalled VPC of 8 GCP nodes ... keeps the cyber-exploit element of the replication trivial”
-
86
The essay, section 5confirmed
scripted test: 3B model reached about half the nodes
The page says “even a 3B model reaches about half the nodes”
-
87
The essay, section 5confirmed
no single point to shut off
The page says “no centralized point to shut off”
-
88
The essay, section 5confirmed
may be slow, doubling time of days
The page says “though it may be slow (with a doubling time of days)”
-
89
The essay, section 6confirmed
defense borrows from epidemiology; R0 below one, dies out instead of staying endemic
The page says “such that the replicator dies out instead of staying endemic”
-
90
The essay, section 6unsupported
R0 defined as average number of new machines each infected one passes worm to
-
91
The essay, section 6confirmed
ISPs spotting traffic pattern in network monitoring
The page says “would leave a network signature, visible as an anomaly in ISP flow-based monitoring systems”
-
92
The essay, section 6confirmed
honeypots: decoy devices that catch a sample
The page says “defenders can use honeypots (decoy devices)”
-
93
The essay, section 6confirmed
quarantine
The page says “an ISP used externally obtained infection evidence to quarantine and notify customers”
-
94
The essay, section 6confirmed
Mirai: quarantining and notifying cleared 92% within 14 days
The page says “This cleared 92% of infections within 14 days”
-
95
The essay, section 6confirmed
against 74% with no notification
The page says “against 74% with no notification”
-
96
The essay, section 6confirmed
authors call for more secure defaults from manufacturers
The page says “more secure defaults”
-
97
The essay, section 6confirmed
default passwords now non-compliant in UK markets
The page says “default IoT passwords are now non-compliant in UK markets”
-
98
The essay, section 6confirmed
UK rules in force since April 29, 2024
The page says “came into effect on 29 April 2024”
-
99
The essay, section 6confirmed
password must be unique or set by the user
The page says “Passwords must be unique per product; or capable of being defined by the user of the product”
-
100
The essay, section 6confirmed
maker must publish how long it will get security updates
The page says “Information on minimum security update periods must be published ... along with an end date”
-
101
The essay, section 6confirmed
NCSC: change a device's default password
The page says “If the device comes with a default password, change it”
-
102
The essay, section 6confirmed
NCSC: turn on automatic updates
The page says “switch on the option to install automatic updates (if available)”
-
103
The essay, section 6confirmed
NCSC: avoid devices whose support has ended or will end soon
The page says “avoid buying devices that are no longer supported by the manufacturer, or whose support period will end soon”
-
104
The essay, section 6confirmed
NCSC: switch off remote access if only used on home Wi-Fi
The page says “If you don't need to access your smart device when you're away from your home Wi-Fi ... switch off the 'remote access' functionality”
-
105
The essay, section 6confirmed
Kimwolf's two million devices mostly off-brand Android TVs, same kind of box the team bought
The page says “over two million devices, primarily off-brand Android TVs ... 15 inexpensive off-brand Android TV boxes”
-
106
The essay, section 6confirmed
Change any default password
The page says “If the device comes with a default password, change it”
-
107
The essay, section 6confirmed
Turn on automatic updates
The page says “switch on the option to install automatic updates”
-
108
The essay, section 6confirmed
Check the support end date before buying
The page says “You can check online to see how long your specific device will be supported ... avoid buying devices ... whose support period will end soon”
-
109
The essay, section 6confirmed
Switch off remote access you don't use
The page says “switch off the 'remote access' functionality”
-
110
The essay, section 6confirmed
the break-in stage was left easy on purpose in the study
The page says “keeps the cyber-exploit element of the replication trivial”
-
111
The essayconfirmed
pull quote is taken from the essay's own words
The page says “blocks[0].sections[2].paragraphs[1]: 'A worm doesn't need to be quick if nobody notices it.' (verbatim; its factual support is flagged UNSUPPORTED at that paragraph)”
Checked for consistency within the issue itself
-
112
Further reading, item 1confirmed
Anthropic study title and description (TV-box test, eight-node network, defenses)
The page says “AI models may be capable of self-replicating without access to a datacenter”
-
113
Further reading, item 2confirmed
Al Jazeera title; news account with outside researcher's view
The page says “AI self-replication on home devices (13 Oct 2026, John Power); Yampolskiy quoted”
-
114
Further reading, item 3confirmed
GOV.UK product security regime page
The page says “came into effect on 29 April 2024”
-
115
Further reading, item 4confirmed
NCSC smart devices guidance; short checklist
The page says “Smart devices: using them safely in your home”
The checker's notes
- A
- l
- l
- c
- i
- t
- e
- d
- f
- a
- c
- t
- s
- p
- r
- e
- d
- a
- t
- e
- D
- =
- 2
- 0
- 2
- 6
- -
- 1
- 0
- -
- 1
- 6
- :
- A
- n
- t
- h
- r
- o
- p
- i
- c
- s
- t
- u
- d
- y
- O
- c
- t
- 1
- 2
- ,
- 2
- 0
- 2
- 6
- ;
- A
- l
- J
- a
- z
- e
- e
- r
- a
- O
- c
- t
- 1
- 3
- ,
- 2
- 0
- 2
- 6
- ;
- U
- K
- r
- e
- g
- i
- m
- e
- 2
- 9
- A
- p
- r
- 2
- 0
- 2
- 4
- (
- p
- a
- g
- e
- l
- a
- s
- t
- u
- p
- d
- a
- t
- e
- d
- 2
- M
- a
- y
- 2
- 0
- 2
- 4
- ;
- m
- e
- t
- a
- d
- a
- t
- a
- t
- i
- m
- e
- s
- t
- a
- m
- p
- 2
- 0
- 2
- 6
- -
- 1
- 0
- -
- 1
- 9
- i
- s
- a
- s
- i
- t
- e
- r
- e
- f
- r
- e
- s
- h
- ,
- c
- i
- t
- e
- d
- f
- a
- c
- t
- i
- s
- f
- r
- o
- m
- 2
- 0
- 2
- 4
- )
- ;
- N
- C
- S
- C
- p
- a
- g
- e
- r
- e
- v
- i
- e
- w
- e
- d
- 2
- 3
- F
- e
- b
- 2
- 0
- 2
- 4
- .
- N
- o
- t
- h
- i
- n
- g
- i
- n
- t
- h
- e
- i
- s
- s
- u
- e
- r
- e
- q
- u
- i
- r
- e
- s
- k
- n
- o
- w
- l
- e
- d
- g
- e
- a
- f
- t
- e
- r
- D
- .
- N
- o
- c
- o
- m
- p
- l
- i
- a
- n
- c
- e
- i
- s
- s
- u
- e
- s
- (
- n
- o
- s
- e
- c
- u
- r
- i
- t
- i
- e
- s
- /
- m
- a
- r
- k
- e
- t
- c
- o
- n
- t
- e
- n
- t
- ;
- A
- l
- J
- a
- z
- e
- e
- r
- a
- U
- R
- L
- s
- i
- t
- s
- i
- n
- i
- t
- s
- /
- e
- c
- o
- n
- o
- m
- y
- /
- s
- e
- c
- t
- i
- o
- n
- b
- u
- t
- t
- h
- e
- a
- r
- t
- i
- c
- l
- e
- i
- s
- g
- e
- n
- e
- r
- a
- l
- n
- e
- w
- s
- o
- n
- A
- I
- s
- a
- f
- e
- t
- y
- )
- .
- N
- o
- f
- i
- r
- s
- t
- -
- p
- e
- r
- s
- o
- n
- s
- t
- a
- t
- e
- m
- e
- n
- t
- s
- .
- Q
- u
- o
- t
- e
- s
- w
- i
- t
- h
- i
- n
- 1
- 4
- w
- o
- r
- d
- s
- a
- n
- d
- a
- t
- t
- r
- i
- b
- u
- t
- e
- d
- .
- N
- o
- l
- i
- n
- k
- e
- d
- i
- n
- _
- p
- o
- s
- t
- f
- i
- e
- l
- d
- i
- n
- t
- h
- e
- d
- r
- a
- f
- t
- .
- M
- i
- n
- o
- r
- :
- p
- a
- g
- e
- i
- n
- t
- r
- o
- s
- a
- y
- s
- 0
- .
- 3
- 9
- t
- o
- k
- /
- s
- ,
- a
- l
- a
- t
- e
- r
- s
- e
- c
- t
- i
- o
- n
- ~
- 0
- .
- 3
- t
- o
- k
- /
- s
- ;
- i
- s
- s
- u
- e
- u
- s
- e
- s
- 0
- .
- 3
- 9
- ,
- w
- h
- i
- c
- h
- m
- a
- t
- c
- h
- e
- s
- t
- h
- e
- h
- e
- a
- d
- l
- i
- n
- e
- f
- i
- g
- u
- r
- e
- .