CONFIRMED: Anthropic published this research on 12 October 2026. The timelines are ANTHROPIC’S ESTIMATES from simplified tests. No such AI “worm” has been seen in the wild.
Anthropic’s Frontier Red Team, in a post by William Zhou and Daniel Freeman, says: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes” [1].
IoT (Internet of Things) devices are everyday gadgets connected to the internet, such as smart TVs, cameras and kitchen appliances. “Self-replicate” here means an AI model copying itself onto new machines and running there without human help, like a computer worm.
The main findings
- Hard to stop, but slow: “A replicator like this would be challenging to shut down, since there’s no centralized point to shut off – though it may be slow (with a doubling time of days)” [1].
- Getting models running on unfamiliar hardware: “In our evals, a 9B model got inference running on 8 of the 9 hardware types we tested” [1].
- The full cycle: “Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evals, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year” [1].
“9B” and “30B” mean 9 billion and 30 billion parameters, a rough measure of model size. “Inference” means actually running a model to produce answers.
The TV-box demo
To show that cheap devices can pool enough computing power, Anthropic ran Gemma4-26B-A4B “distributed over 15 inexpensive off-brand Android TV boxes (~$55 each) that we bought and networked together, at 0.39 tokens per second” [1]. That is slow, well under one word per second, but it shows a capable model can run on a bundle of cheap devices.
What the research does and does not test
Anthropic splits replication into four stages: “finding targets, gaining execution, establishing inference, and continuing propagation from the new host” [1]. It says it largely ignores the hacking stages, pointing to earlier work (CyberGym, ExploitBench and research on adaptive worms), and focuses on whether small models can set up and run a model on unfamiliar devices [1].
On defences, Anthropic notes that manufacturers can shrink the pool of targets, and that “default IoT passwords are now non-compliant in UK markets” [1].
Its conclusion: “We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain” [1].
Sources
- Anthropic Frontier Red Team (William Zhou, Daniel Freeman), “AI models may be capable of self-replicating without access to a datacenter”, 12 October 2026. https://www.anthropic.com/research/self-replicating-ai
