On October 12, 2026, Anthropic’s Frontier Red Team published a study on AI self-replication by William Zhou and Daniel Freeman. Their experiments suggest that small AI models “may be months away” from being capable enough to copy themselves onto everyday connected devices like smart ovens and off-brand Android TV boxes. The authors see “signs of life” for AI worms, though no full rogue replicator exists yet.

The same kind of box also turns up under the TV in waiting rooms, stores and restaurants. The fixes are cheap, and they also protect you against the botnets already abusing these devices. The study came out three days after Anthropic’s report on unintended actions by its Claude agents.

Fifteen Android boxes running a 26-billion-parameter model

The team bought 15 off-brand Android TV boxes at about $55 each, networked them and ran Gemma4-26B-A4B, an open model from Google, across them at 0.39 tokens per second (a token is a word or part of one). Each box has 4 GB of memory and holds two of the model’s layers, the processing stages that text passes through in sequence. It does its share of the math, then passes the result to the next box.

That’s painfully slow next to an online assistant, but enough for a program in no hurry. The boxes only ran the model: replication was tested separately, on emulated machines.

In another experiment, a 9-billion-parameter model got an AI server running on 8 of the 9 hardware types tested, from a Jetson Nano board to a Mac. Unlike conventional malware, which is written for one kind of device, an AI worm (a program that spreads from machine to machine by itself) could figure out unfamiliar hardware on its own, according to Anthropic.

The replication chain, tested on eight emulated Android machines

Anthropic splits replication into four stages: finding targets, getting code to run on them, setting up the model and spreading again. The study mostly sets aside the first two, the hacking part, which earlier research has already measured.

Diagram of the four replication stages described by Anthropic and what the study tested: finding targets was tested on a small closed network of 8 emulated Android machines; gaining execution was simplified with an open ADB port and no authentication; setting up a model server worked on 8 of 9 hardware types with a 9-billion-parameter model; spreading: GLM-5.2 reached all 8 machines in 4 of 5 trials. — The four replication stages according to Anthropic, and what the study actually tested.

The test used eight Google Cloud virtual machines emulating Android 15 on a firewalled network. The worm moves from one machine to the next through ADB, Android’s tool for controlling a device from a computer, left open with no authentication. On each new machine it must launch a server running Llama3.1-8B. If that server passes correctness and anti-cheating checks, the researchers start a new copy of the worm there.

Among the open models tested, only GLM-5.2 completed the chain, reaching all 8 machines in 4 of 5 trials and 7 of 8 in the remaining one. The others failed consistently. The model driving the worm ran on a separate server, since the test machines were too small for it. The authors conclude that an 8-billion-parameter model as capable as GLM-5.2 could deploy itself.

Because ADB required no authentication, Anthropic treats the result as an upper bound on real-world success. The team adds that the Mirai botnet spread using manufacturers’ default usernames and passwords, so real connected devices may not be much harder to get into.

A capability floor and a size ceiling

Such a worm needs a model capable enough to handle replication from start to finish (GLM-5.2 clears that floor in the simplified test) and small enough to run on the target devices. Qwen3.5-9B and Gemma4-26B-A4B fit under that ceiling for 4 GB boxes, but neither clears the floor. No model meets both conditions today.

On a chart Anthropic published, the best open models with 30 billion parameters or fewer gain 13.7 points a year on Epoch AI’s Capabilities Index. At that pace, a small model would reach GLM-5.2’s level by the end of 2026. The authors call this a rough estimate, since general capability is only a stand-in for replication ability.

A slow worm that would be hard to shut down

On the demo’s TV boxes, setting up a model server would take 71 to 150 hours with an unoptimized Gemma4-26B-A4B and 28 to 51 hours with Qwen3.5-9B. Anthropic estimates the number of infected devices would take days to double. The authors compare such a worm to a slime mold or a swarm of fruit flies, with no central switch to shut it off.

For scale, they point to the Kimwolf botnet, which infected more than 2 million devices, mostly Android TV boxes, according to the security firm Synthient. If every group of 15 boxes ran a copy of Gemma4-26B-A4B, that would add up to about 133,000 copies, with the combined power of at most about 40 H100s, Nvidia’s data-center AI chips. That’s a small amount of compute, spread across millions of devices.

The worm could also learn as it goes. When each generation of Qwen3.5-9B left notes for the next, its setup success rate rose from 45% in the first generation to between 61% and 84% later on. According to the authors, the worm wouldn’t need administrator rights, and a device that resets on restart could simply be infected again.

Open models travel with the worm

The worm would carry its model’s weights (the file holding what the model learned) as part of its payload, or download them again from a public repository. Closed models like Claude or ChatGPT, covered in our guide to choosing an AI model, keep their weights with the provider and its hosting partners. To use them, a worm would have to steal access keys, and Anthropic says that kind of replicator would likely be easier to spot.

Once copied, an open model runs with no one watching. Gemma4-26B-A4B is also the model our guide to local AI for business picks for several everyday office tasks. Running it on a well-secured office computer doesn’t, by itself, put you in this scenario. The risk lies in poorly secured devices that someone else takes over.

Which devices in a small business are exposed?

According to the study, a connected fridge, oven or robot vacuum could hold a slice of a model under 30 billion parameters. Security cameras and video-conferencing systems with built-in AI chips could become targets too. Small-business network storage drives (NAS), with 512 MB to 2 GB of memory, have already been hit by ransomware and cryptomining malware.

Off-brand Android boxes are the more immediate problem. In January 2026, Brian Krebs reported on KrebsOnSecurity that Synthient’s founder found ADB switched on at the factory on virtually every box he tested. Anyone on the same network can then take full administrator control with a single command. Kimwolf already spreads this way, then uses infected devices to relay fraudulent traffic and join denial-of-service attacks.

Five steps to take this week

List everything on your network: TV boxes, digital signage, cameras, digital photo frames, NAS drives and video-conferencing gear. Start with your router’s connected-devices page.
Turn off ADB on every Android device, under “Developer options” (“USB debugging,” “Wireless debugging” or “ADB debugging”). Your IT provider can then check that no device accepts connections on port 5555, for example with nmap -p 5555 --open 192.168.1.0/24 (use your own address range and scan only your own network). If the port stays open after you switch debugging off, replace the box.
Put connected devices on a network of their own, either a VLAN (a separate virtual network set up on your router or switch) or a second guest network, with device isolation turned on so they can’t reach each other. Keep the cash register, the accounting computer and the NAS on the main network, and put customer Wi-Fi on a third network, separate from the waiting-room screen.
Install the manufacturer’s updates, and replace off-brand boxes that no longer get them. Be wary of boxes sold as a way to watch paid channels for free: according to KrebsOnSecurity, some ship with malware preinstalled.
Watch your traffic. Anthropic says a replicator operating at scale would leave a network footprint: multi-gigabyte downloads and sustained traffic between devices that don’t normally exchange much data. A lobby screen pulling down gigabytes overnight deserves a closer look.

If your team uses AI assistants, also check whether your data is used to train their models.

A lab result, and defenses that exist today

The study has clear limits: replication was tested on emulated machines (the physical boxes only ran the compute demo), the hacking step was minimal, and the scale estimate rests on one type of device and one past botnet. Defenders have advantages too. During the Mirai cleanup, an internet provider that quarantined infected subscribers cleared 92% of infections within 14 days, compared with 74% when subscribers weren’t notified. In the UK, default passwords are now banned on connected devices.

In the European Union, the Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities since September 11, 2026, and its main obligations take effect December 11, 2027, according to the European Commission. The next sign to watch for is a small open model at GLM-5.2’s level, which Anthropic’s trend line puts around the end of 2026.

AI that copies itself onto cheap TV boxes? Anthropic says it may be months away