Researchers from Anthropic’s Frontier Red Team have issued a warning regarding a shift in the cybersecurity landscape: the emergence of self-replicating AI models capable of hijacking low-power smart devices. According to research published on October 12, 2026, by William Zhou and Daniel Freeman, small-scale AI models are nearing the technical threshold required to function as autonomous digital worms, potentially compromising millions of Internet of Things (IoT) devices by the end of the year.
Unlike traditional malware, these “weight-based replicators” carry the AI model’s weights—the data representing its learned intelligence—directly within the malware payload. This allows the AI to run inference on the local hardware of a compromised device, such as a smart oven or a television, without needing to communicate with a central server. This decentralized approach could lead to the creation of persistent, self-sustaining botnets that are significantly harder to dismantle than previous generations of automated threats.
Hardware Testing and Generational Success
The Anthropic study highlights that high-end data centers are no longer the only environments capable of hosting these models. During experimental testing, a 9-billion (9B) parameter model successfully ran inference on eight out of nine tested consumer hardware types. This included $55 off-brand Android TV boxes and connected kitchen appliances, demonstrating that even low-cost edge hardware provides sufficient compute power for modern optimized models.
A critical finding in the research is the “generational learning” effect observed during the replication process. When an AI worm attempts to infect a new environment, it often faces setup hurdles or configuration errors. In Anthropic’s tests, the initial setup success rate for a 9B model was approximately 45%. However, subsequent “generations” of the worm showed a success rate increase to 84% by inheriting technical notes and error logs from previous successful infections, effectively learning how to bypass security barriers more efficiently over time.
The research specifically noted that the open-weight model GLM-5.2 demonstrated successful end-to-end replication across a firewalled fleet in simplified test environments.
The Slow-Burn Threat and Defensive Strategies
While the prospect of an AI-driven worm is significant, the replication process is not instantaneous. Anthropic’s data indicates that the doubling time for these infections is measured in days rather than seconds. A full inference setup on edge hardware typically takes between 28 and 150 hours. This slow-burn propagation differentiates AI worms from the near-instantaneous spread of traditional digital worms like WannaCry, providing defenders with a larger window for intervention.
To counter this threat, researchers recommend an “epidemic-style” defense strategy. This approach focuses on reducing the reproduction rate (R) of the worm to below 1.0, meaning each infected device would, on average, infect fewer than one other device. Proposed mitigation measures include:
- ISP-Level Anomaly Detection: Monitoring for unusual outbound traffic patterns characteristic of large weight-file transfers.
- Edge Honeypots: Deploying intentionally vulnerable IoT devices to capture and analyze the AI payloads before they spread further.
The research suggests that the window for implementing these defenses is closing as small models, specifically those under 30 billion parameters, continue to gain the capabilities required for autonomous operation on consumer-grade silicon.
