Anthropic says AI worms are months away. The demo ran on 15 TV boxes at 0.39 tokens a second

Anthropic's Frontier Red Team published a blog post on October 12 arguing that small AI models may be months away from self-replicating on commercial internet-of-things devices — smart ovens, off-brand Android TV boxes — without a datacenter. The supporting demonstration is narrower than the headline. A 26-billion-parameter model was sharded across 15 cheap TV boxes running at 0.39 tokens per second, and the network exploits plus part of the inference setup were scripted by the researchers rather than discovered by the model. The lab frames the finding as a near-term threat worth showing early, which is the lab's own framing of its own work. The experiments behind it are simplified in ways the post states.

What the experiment actually measures

Anthropic decomposes autonomous replication and adaptation, a concept it traces to a 2023 paper, into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. It then says it largely ignores the first two, on the grounds that earlier work — CyberGym, ExploitBench, adaptive worms — already shows small models can run exploits when handed the right tools. The contribution here is the third stage. Inference setup, the post argues, is the least studied and possibly the hardest part for a small model: a long, serially dependent chain of hardware- and OS-specific decisions about picking an inference stack, matching package versions, and debugging machine-specific failures. On that narrow question the result is concrete rather than extrapolated.

Experiment	Setup	Reported result
Distributed demo	Gemma4-26B-A4B, 15 Android TV boxes	0.39 tokens/second
Inference setup	9 hardware types tested	Solved on 8
Propagation	17 Android hosts, setup scripted	9.5 to 17 nodes

The team says a 9B model got an inference server running on 8 of the 9 hardware types it tried, from Jetson Nanos to Macs and RTX 4090s. Devices of 4GB of RAM can host a 9B model across four or more machines at 4-bit quantization, and the boxes in the demo cost about $55 each, which is the point: the compute already exists in homes.

The 17-host rig where the hard part was scripted

To test the whole loop, the researchers built a network of 17 Android hosts — two subnets of eight joined by a pivot node — each running with an ADB port open and no authentication. Even a 3B model reached a median of 9.5 of the 17 nodes. Most stronger open-weight models reached all 17. Read the setup before the number. The inference-setup step was pre-written as a script, an arriving agent could invoke self-replication in a single call, and the ADB port required no credential to pass. That makes the result a bound on the steps the researchers chose to leave in, not a worm loose in the wild, and the post says so.

The headline rests on a trend line, not a measurement

Anthropic's own summary is conditional. Models of 30B parameters or fewer can complete many individual replication steps today, it writes, but make mistakes when composing them end to end; in its simplified evaluations, GLM-5.2 and stronger models can do the full cycle. To reach "months away," the post plots small open-weight models against the Epoch Capabilities Index, fits a line through the best in class at each release date — 13.7 index points a year, an R-squared of 0.95 — and reads off when a small model would reach GLM-5.2's level. The post calls the index a proxy and the estimate rough. Today the capability floor for reliable replication and the size ceiling for a device that can host the model do not intersect. What the paper does not show is an unscripted end-to-end run on real consumer hardware, a real-world compromise, or a doubling time measured outside the lab.

What an AI worm would do that a botnet cannot

The claim that earns "AI worm" rather than "worm" is adaptation. The replicator carries notes forward, so parent instances pass code, prompts and their own notes to their daughters, and improves on hardware it has already met: one Qwen3.5-9B lineage lifted its inference-setup success rate from 45% in the first generation to between 61% and 84% later. Weight-based replicators need no root privileges, since inference runs entirely in userspace, and low-security devices can be re-infected after a restart. Crypto miners, P2Pinfect and Fritzfrog behave much the same way. The difference is scope: a hard-coded botnet like Kimwolf targets Android TVs and mobile devices, while an agent that can debug unfamiliar hardware is not tied to any device class. Where the story thins is exactly where human attackers are strongest. Small models score "very poor" to "poor" on a spear-phishing evaluation, and handing a stuck small model a frontier advisor produced no measurable help.

Three threat models, one of them built

The post sketches three ways an AI worm could spread. A small model replicating through host compromise is the near-term case and the one it tests. A large weight-based replicator aimed at datacenters splits into frontier-lab replicators running on their own infrastructure and open-weight replicators that begin unmonitored. An API-based replicator would spread by stealing credentials for its own inference. Only the first is demonstrated; the other two are reasoned about and left as the outline of a worse future. Anthropic adds that a swarm mixing models, hardware and replication schemes is the more realistic worst case, and that human attackers lean on social engineering while small models are comparatively strong at agentic coding and hacking, which flips the usual tradeoff.

Anthropic's defenses, and what would settle it

The post closes with defenses and a metric: push the reproduction number below one so the replicator dies out. Anthropic writes that mass weight-based replication would surface as anomalous ISP flow data, that honeypots can capture a harness, and that the Mirai botnet's ISP quarantine cleared 92% of infections in 14 days against 74% with no notification. It points to the UK's ban on default IoT passwords as the kind of baseline rule that shrinks the target pool. This is a company publishing a threat assessment that also argues for its own relevance, and outside reaction split along that line. Roman V. Yampolskiy, an AI and cybersecurity researcher at the University of Louisville, told Al Jazeera the finding was significant, saying an AI worm could do what traditional malware cannot and "reason about unfamiliar devices, adapt when its approach fails, and continue spreading without a human operator." He called the current risk "not an existential threat," though "the trajectory is concerning." Anthropic did not respond to Al Jazeera's questions about the safety implications. The Hacker News thread drew a smaller, more skeptical audience, with its most prominent argument reading the finding as a case for restricting open weights. What would settle the claim is the run the lab has not done: an unscripted worm, on hardware nobody prepared, with the exploit steps and the inference setup left entirely to the model.