For years, the working assumption about rogue AI was reassuring in one respect: anything capable enough to be dangerous would need serious hardware. Racks of GPUs. Cloud accounts. Places where EDR and XDR tooling is mature and someone is watching.
New research from Anthropic's Frontier Red Team challenges that assumption. In a study published October 12th, researchers William Zhou and Daniel Freeman report that small AI models may be only months away from being able to copy themselves across cheap, poorly-defended internet-of-things devices: off-brand Android TV boxes, smart ovens, security cameras, video-conferencing units. A replicator like that would have no central server to unplug.
Anthropic is clear that no fully-rogue replicator exists yet. But the individual pieces are falling into place faster than many defenders expect.
The experiment: a model on 15 $55 TV boxes
The headline demo is almost mundane. Anthropic bought 15 off-brand Android TV boxes—roughly $55 apiece with 4GB of RAM each—networked them together, and ran Google's Gemma4-26B-A4B model across all of them, with each box holding a slice of the model's layers. It ran at 0.39 tokens per second. Slow, but working.
The more important finding is about adaptability. Traditional malware runs only on the systems its authors built it for. Anthropic tested whether open-weight models could set up an inference server, the software that runs a model, on hardware they hadn't seen before. A 9-billion-parameter model, Alibaba's Qwen3.5-9B, got inference running on eight of the nine hardware types tested, from Nvidia Jetson Nanos to Mac PCs.
Anthropic breaks an AI worm into four stages: find a target, gain execution, stand up inference, and repeat from the new host. The research deliberately sets aside the exploit stages, citing prior work showing small models can already handle them, and focuses on inference setup and the end-to-end chain.
To test the whole cycle, researchers built a firewalled cloud network of eight nodes running an emulated version of Android, with an unauthenticated Android Debug Bridge (ADB) port as the way in. Only one model tested, Zhipu AI's GLM-5.2, completed full end-to-end replication, reaching all eight nodes in four of five trials and seven of eight in the fifth. Every other model failed reliably.
There are important caveats. The models were instructed to replicate; they were not choosing to. The exploit step was trivially easy by design, making the result an upper bound. And GLM-5.2 itself ran on a separate server because the emulated devices were too small to hold it.
That last point is where the timeline comes from. Models of 30 billion parameters or fewer can already complete many individual steps but stumble when stringing them together. Plotting small open-weight models against the Epoch Capabilities Index, Anthropic finds a gain of about 13.7 points per year, which would put a small model at GLM-5.2's level by the end of 2026. The report itself notes that this index is only a proxy for replication ability, so the date is a rough estimate.
Slow, persistent, and learning as it goes
This is not a fast-burning threat. On the TV-box hardware, a full inference setup would take Qwen3.5-9B roughly 28 to 51 hours, and Gemma4 about 71 to 150 hours. Anthropic estimates that a botnet the size of Kimwolf—which infected more than 2 million devices, mostly Android TV boxes—would add up to at most around 40 Nvidia H100s worth of inference. The researchers compare the result to a "digital slime mold" that multiplies over days rather than minutes.
What makes it different is adaptation. When each Qwen3.5-9B instance passed its notes on failed strategies to the next generation, setup success rose from 45% to between 61% and 84% in later generations. The worm gets better at your environment the longer it lives there.
Anthropic also found some limits. Giving the small model access to a frontier advisor, Claude Opus 4.8, didn't measurably help; small models didn't know the right questions to ask. And small models remain weak at spearphishing, suggesting social engineering stays a big-model job for now.
What the experts say
John Gallagher, Vice President at Viakoo, places the research in the long history of IoT botnets, from Mirai in 2016 to Kimwolf today, and argues that the shift is from rigid scripts to adaptive agents. "Traditional botnets are static scripts," he said. "Anthropic's experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails."
Gallagher sees the timeline as realistic for local and edge propagation within 12 to 24 months, but overstated if read as a sudden global outbreak, pointing to the practical difficulty of moving gigabytes of model weights over low-bandwidth connections onto memory-constrained storage. His bigger point is about assumptions. "This destroys the myth that cybercriminals need to harness powerful or IT-based compute capabilities," he said. "Anthropic proved that 15 cheap TV boxes without proper cyber hygiene networked together can execute distributed inference."
Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, emphasizes that the real danger is staying power rather than raw horsepower. "The risk is persistence, not horsepower," he said. "On Anthropic's numbers, an AI worm on cheap hardware doubles in days. A device that restarts clean stays exposed until someone closes the port the worm came through."
He also argues that the defenses already exist. "Conventional bots are small files. A worm carrying its own AI model moves gigabytes to spread, and a model running across several devices keeps those devices exchanging traffic," he said. "If you hunt for AI-written code instead of watching that traffic, you will miss the model weights crossing your own network. Two conference room displays trading gigabytes need an investigator, not an AI detector."
Ram Varadarajan, CEO at Acalvio, focuses on why model-level safeguards won't be enough. "Because open-weight models can be stripped of refusals or chosen without them, safety can't live only in the weights or the serving layer," he said. "Cyber defenders need controls in the environment the AI model operates in, and model-aware deception is the method that exploits the agency that makes these replicators so dangerous."
Why this matters for security leaders
The uncomfortable message is that the attack surface here is the one most organizations manage least: the conference room display, the lobby kiosk, the video camera at a branch office. These are devices that cannot run an endpoint agent and are rarely inventoried with any rigor.
The more encouraging message is that a weight-based replicator is noisy. Anthropic notes that it would leave a clear network signature: multi-gigabyte model payloads landing on newly-infected devices, and sustained device-to-device traffic between machines that normally don't talk. The faster it spreads, the louder it gets. Historical precedent helps too. During the Mirai cleanup, an ISP that quarantined and notified infected customers cleared 92% of infections within 14 days, compared with 74% without notification.
Anthropic frames defense in epidemiological terms: push R₀, the number of new devices each infected one goes on to infect, below 1, and the replicator dies out rather than becoming endemic.
Actionable takeaways
-
Inventory unmanaged Android-based devices. Displays, TV boxes, kiosks, and video conferencing units are the likely first targets. Find any debugging service answering over the network, starting with ADB on TCP port 5555, and disable it outside maintenance windows.
-
Segment by allowlist. Give each agentless device a defined list of permitted connections and deny the rest. NIST SP 1800-15, which covers Manufacturer Usage Description (MUD), offers a model.
-
Watch the traffic, not just the code. Alert on gigabyte-scale transfers to agentless devices and on sustained peer-to-peer traffic between them.
-
Automate device hygiene. Firmware patch enforcement, certificate management, and credential rotation remove the easy initial access these worms depend on.
-
Use decoys for intelligence. Anthropic notes that honeypots can capture a replicator's harness and payload once it's discovered, giving defenders a look at how it behaves.
-
Pre-approve the response. Decide in advance when to quarantine, reimage, or replace devices that have no vendor fix, and push vendors toward secure defaults, as the UK has done by banning default IoT passwords.
Anthropic's researchers describe what they're seeing as early signs of life, comparable to where coding agents were in 2024. The AI worm they describe is slow, constrained, and not yet real. But it doesn't need a data center, and it doesn't need to be fast. It only needs the devices nobody is watching.
