Anthropic’s Frontier Red Team says small open-weight AI models could, within months, be able to spread themselves across cheap, badly secured smart devices. Nobody has built such a worm yet, but the research turns a long-standing IoT hygiene problem into an AI security problem for UK networks.
What happened
On 12 October 2026 Anthropic published research by William Zhou and Daniel Freeman of its Frontier Red Team. They asked whether an AI model could act like a worm: reach a new machine, copy its weights and tooling across, start running there, then move on. The focus is what they call weight-based replicators, small models living directly on compromised hardware rather than calling a cloud API.
The headline finding is that small models “may be months away” from being able to do this on commercial internet of things (IoT) devices. They have not built a complete rogue replicator, and their end-to-end test deliberately made the hacking step trivial. Follow-up coverage by Cyber Security News and CP24 stressed that this is progress towards a threat, not an outbreak.
The technical picture
The researchers broke replication into four stages: locating victims, getting code to run, standing up a working model, and spreading onward. They mostly skipped the first two, citing earlier academic work showing small models can already exploit systems when given suitable tools. Their focus was the less studied part: can a small model get an inference stack working on hardware it has never seen?
The answer was mostly yes. A 9B-parameter model got inference running on eight of the nine hardware types tested. As a physical demonstration, the team bought 15 Android TV boxes at roughly $55 each, all with 4GB of RAM. They spread Gemma4-26B-A4B across the boxes using pipeline parallelism, so each box held a couple of the model’s layers. The result ran at 0.39 tokens per second.
For the full replication cycle, the team built a firewalled Google Cloud network of eight nodes running an Android emulator. Every node had Android Debug Bridge (ADB) exposed with no authentication. Of the open-weight models tested, only GLM-5.2 reliably completed the loop: it reached all eight nodes in four of five trials and seven in the fifth. In this test the worm’s own model ran on a separate server; its job was to stand up Llama3.1-8B on each node, as a proxy for a future small model with GLM-5.2’s ability.
Three further results stand out:
- Timeline: plotting small open-weight models against the Epoch Capabilities Index, the authors’ trend line puts a sub-30B model at GLM-5.2’s level by the end of 2026. They describe this as a rough proxy.
- Learning across generations: when each Qwen3.5-9B instance handed its notes to the next, inference setup success rose from 45% to between 61% and 84%.
- Speed: spread would be slow. A single Qwen3.5-9B setup was estimated at 28 to 51 hours, so the doubling time would be days rather than minutes.
To gauge scale, the authors used Kimwolf, the botnet that peaked at more than two million devices, mostly Android TV boxes. If a fleet that size ran one model copy per 15 boxes, it would host about 133,000 replicas. That is little compute, but there would be no central server to switch off.
Why it matters for UK organisations
The interesting UK detail is that Anthropic’s paper names British law as part of the answer. It observes that shipping IoT kit with default passwords no longer complies with British rules. That means the product security regime under the Product Security and Telecommunications Infrastructure Act 2022, which has applied since 29 April 2024. It requires passwords that are unique per device or set by the user, a published route for reporting security issues, and a stated minimum period for security updates. The Office for Product Safety and Standards (OPSS) enforces it against manufacturers, importers and distributors.
The difficulty is that the devices this research describes are exactly the ones that slip through. Anonymous Android boxes bought from online marketplaces, often running unhardened forks of the Android Open Source Project, may arrive without a statement of compliance or any clear update commitment. Many end up in offices and staff homes. On a flat network beside business systems, one gives an adaptive agent a foothold it can explore without a human operator.
The research also widens the target list. The authors point out that small-business NAS boxes have a history of being vulnerable to ransomware and cryptojacking. Smart cameras and conferencing units increasingly ship with AI accelerators, which makes them more useful to a replicator.
Expert view
No AI worm is loose, and the test removed the hardest real-world step by leaving ADB open. I would not take much comfort from that. In my experience, the hacking step on consumer-grade kit is often trivial in practice. Mirai spread largely by trying manufacturer default credentials, and the paper makes the same point. When we test corporate networks, rogue streaming sticks and forgotten NAS units on flat VLANs are routine findings.
What changes is the operator. Traditional botnets are written for a specific device family and break when they meet something new. A model that can read error messages, try another inference engine and pass its notes to its successors is a different kind of opponent. Slow spread is not necessarily good news: a quiet threat can be harder to notice than a noisy one, especially where nobody monitors the network.
The positive side is that the defences are familiar. The authors argue that a replicator moving multi-gigabyte model files and holding sustained device-to-device conversations would leave a clear network signature. They also cite Mirai remediation work in which an ISP quarantined infected customers and notified them, removing 92% of infections in a fortnight, compared with 74% where customers were not told.
What to do now
- Find the unmanaged devices. Run asset discovery for Android TV boxes, smart displays, cameras and NAS units. This matches the Cyber Essentials requirement to know and control the devices in scope.
- Segment IoT. Put smart and AV devices on their own VLAN with no route to corporate systems, and allow outbound traffic only to the services they need.
- Close ADB and remote management. Block TCP 5555 and similar debug or management ports at the perimeter and between segments.
- Change and record credentials. Replace any default or shared passwords on devices bought before the PSTI regime, or from sellers who cannot show compliance. This is secure configuration in Cyber Essentials terms.
- Watch for model-sized traffic. Alert on large unexpected downloads to IoT segments, internal scanning and sustained peer-to-peer flows between devices that normally stay quiet.
- Tighten procurement. Buy connectable products only where the supplier publishes a security update period and a vulnerability reporting contact. Report non-compliant products to OPSS.
Bottom line
Anthropic has not found an AI worm. What it has shown is that most of the pieces are falling into place, and the timeline it gives is measured in months. The weak point is not the AI but the millions of cheap, unmanaged gadgets already on networks. UK organisations have the legislation and the controls to shrink that pool. They now have a much stronger reason to use them.
Sources
- Anthropic: AI models may be capable of self-replicating without access to a datacenter
- Cyber Security News: Anthropic Warns AI Models Could Soon Self-Replicate on Smart TVs and IoT Devices Without a Data Center
- CP24: Anthropic warns of AI ‘worms’ spreading across smart gadgets
- GOV.UK: The UK Product Security and Telecommunications Infrastructure (Product Security) regime
