In their latest research, Anthropic said small AI models may be only "months away" from gaining the ability to clone themselves and spread across internet-connected devices. The ability to reproduce themselves without human control would make it hard to control such agents because there's no centralized point to shut off when looking at consumer devices.
Anthropic described how AI models could use their computing power to run themselves and spread to other devices, without relying on expensive data centers. Smart devices in people's homes, as well as internet-connected devices such as security cameras, are vulnerable given that internet-enabled devices tend to have weaker security protections, the Anthropic researchers said.
In what they described as a worst-case scenario, a swarm of AI agents — bots that work together to accomplish a shared goal — could propagate across computer hardware using "replication schemes." The researchers said they are unsure of what form these attacks could take, noting that the AI models could be distributed as "digital slime mold" or as more powerful models capable of hacking into data centers.
The company acknowledged that there is not yet a “fully rogue replicator.” While the primary focus seems to be smart devices in the home, a next step for an evolving agent could be targeting OT assets on plant floors or throughout critical infrastructure. We've already seen the impact of escalating hacks on numerous water treatment facilities that were presumably scaled more quickly with AI tools.
The report generated significant feedback from throughout the cybersecurity industry.
John Gallagher, V.P. at Viakoo
"For a long time OT/IoT devices have been a preferred target for botnets due to a lack of effective automated cyber hygiene. The Mirai botnet in 2016 primarily used video recorders and related devices to launch massive attacks, and more recently botnets like KimWolf.
"This is different - traditional botnets are static scripts. Anthropic’s experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails.
"This can be considered a breakthrough because it leverages the ability of frontier AI to work and adapt to multiple operating systems. There are over 150,000 unique operating systems with OT/IoT devices, and without AI that would otherwise be a barrier to the reach of bots placed on OT/IoT devices.
"Anthropic’s timeline for practical AI self-replication seems highly realistic for local/edge propagation within 12–24 months but is overstated if viewed as a sudden global 'digital slime mold.' While today’s OT/IoT devices contain significantly more compute power and storage than older systems, there are other barriers to achieving practical AI self-replication. For example, moving gigabytes of model weights over cellular/low-bandwidth OT/IoT connections or onto memory-constrained flash storage remains a massive practical hurdle.
"Automating OT/IoT device cyber hygiene is non-negotiable. Defenders cannot rely on 'device obscurity' or low compute specs to protect edge assets. Every OT/IoT device must have automated firmware patch enforcement, active certificate management, and automated password rotation to eliminate initial access entirely. This destroys the myth that cyber criminals need to harness powerful or IT-based compute capabilities.
"Defenders historically assumed that sophisticated AI models require expensive datacenter GPUs, meaning an AI-driven attack would need to touch AWS, Azure, or private clusters where detection tools (EDR/XDR) are mature. Anthropic proved that 15 cheap TV boxes without proper cyber hygiene networked together can execute distributed inference."
Collin Hogue-Spears, Sr. Director at Black Duck
"A scripted worm runs only where its authors compiled it. In Anthropic's October 12 test, Alibaba's Qwen3.5-9B configured unfamiliar hardware itself and set up a model server on eight of nine hardware types. That test held the door open on purpose and measured what a model does once inside.
"Anthropic tested models under orders to replicate, not models choosing to. The propagation test ran on emulated devices, and the model steering the worm, Zhipu AI's GLM-5.2, ran on a separate server because the emulated devices were too small to hold it. Anthropic says it has no full worm yet, and its end-of-2026 projection rests on what the report calls a proxy metric.
"The AI worm Anthropic describes spreads in four steps: find a device, break in, set up a model there, and repeat from the new host. Mirai carried a password list. An AI worm carries a model, and its new work starts after the break-in: installing an inference engine, the software that runs a model, on the device it just entered.
"Cheap devices hold only small models, so Anthropic's scenario centers on open-weight models of 30 billion parameters or fewer, files anyone can download and run. Today those models complete individual steps and fail at the full sequence. A 4-gigabyte TV box cannot hold Google's 26-billion-parameter Gemma 4 on its own. Fifteen boxes pooled their memory to run the model at 0.39 tokens per second in Anthropic's test. No worm spread between those boxes; the run measured inference alone.
"Anthropic's candidate first targets are home and small-business devices: Android TV boxes, plus security cameras and video-conferencing units whose new AI chips offer a worm extra computing power.
"A working AI worm would turn a company's unmanaged devices into attack hosts, and the defenses are the ones that already contain scripted botnets. By Anthropic's estimate, two million hijacked TV boxes add up to at most about 40 Nvidia H100 data-center GPUs. The risk is persistence, not horsepower.
"On Anthropic's numbers, an AI worm on cheap hardware doubles in days. A device that restarts clean stays exposed until someone closes the port the worm came through. The cost to a business is cleanup: isolating, then fixing or replacing, devices that often have no patch to apply.
"Conventional bots are small files. A worm carrying its own AI model moves gigabytes to spread, and a model running across several devices keeps those devices exchanging traffic. Anthropic itself names those multi-gigabyte transfers and the sustained device-to-device traffic as the signals to watch.
"Security leaders must start with the devices that cannot run an endpoint agent, from conference-room displays to cameras. Give each one a written list of permitted connections and deny the rest; NIST's Manufacturer Usage Description guidance, SP 1800-15, shows how. An AI worm adapts to the device it reaches. Segmentation limits which devices an AI worm reaches.
"Inventory every Android-based appliance and find any debugging service that answers over the network, starting with Android Debug Bridge on TCP port 5555. Disable each one outside maintenance windows. Anthropic's test worm paired new AI with Kimwolf's old way in an open Android debug port.
"Then alert when a device with no endpoint agent pulls a gigabyte-scale transfer from a peer device or an unapproved host or holds sustained traffic with another such device. Pre-approve the response path: investigate, quarantine when the traffic has no business explanation, then reimage or replace devices with no vendor fix.
"Leave devices without an endpoint agent on a flat network with a debug port answering, and you hand any self-spreading worm its path from one device to the next. If you hunt for AI-written code instead of watching that traffic, you will miss the model weights crossing your own network. Two conference-room displays trading gigabytes need an investigator, not an AI detector.
Ram Varadarajan, CEO at Acalvio
"Because open-weight models can be stripped of refusals or chosen without them, safety can't live only in the weights or the serving layer. Cyber defenders need controls in the environment the AI model operates in, and model-aware deception is the method that exploits the agency that makes these replicators so dangerous.
"Anthropic's researchers have found that small AI programs may soon be able to copy themselves from one cheap connected device to the next, such as smart TV boxes and ovens, learning how to work on unfamiliar hardware as they go. This would make them a new kind of computer worm that traditional security tools, built to recognize known threats, are ill-equipped to catch.
"The better defense will be to seed networks with convincing decoy devices designed to attract these AI-driven intruders, so defenders can watch how they behave and intercept them before they spread."
