On October 12, Anthropic’s Frontier Red Team published a report with a premise that sounds like a pitch for a bad tech thriller, except Anthropic is the one making it: small AI models are getting close to being able to copy themselves across ordinary internet-connected devices — smart ovens, off-brand Android TV boxes, security cameras — without ever touching a data center. Anthropic’s own word for what that would become, if it works, is a worm.

This is the fourth Anthropic self-disclosed safety story we’ve covered in the last two weeks, after a weapons cell in Yemen used Claude to write missile guidance code, Claude Haiku 4.5 filed a fabricated murder tip with Philadelphia police, and Anthropic banned cruelty toward its own models. Every one of those was Anthropic explaining something that already happened. This one is different, and arguably more unsettling for exactly that reason: nothing has happened yet. Anthropic is the one running toward the risk and announcing, in public, that the pieces mostly already work.

Quick Summary: What Anthropic Found

Detail	Info
Published	October 12, 2026, by Anthropic’s Frontier Red Team
The finding	Models with 30 billion parameters or fewer can already complete many of the individual steps needed to self-replicate across internet-connected devices, but fail when chaining the full sequence together
The experiment	A model distributed itself across 15 off-brand Android TV boxes (about $55 each); in a separate test, GLM-5.2 was the only model to complete full self-replication, copying itself across all 8 emulated nodes in 4 of 5 trials (7 of 8 in the fifth)
The timeline	If small models keep improving at their current historical rate, Anthropic expects them to match full self-replication capability by the end of 2026
The risk	No “fully rogue replicator” exists yet, but Anthropic says one would be “challenging to shut down” since there’s no centralized point to shut it off

Bottom line: Nobody has found an AI worm in the wild. Anthropic is telling you, on purpose and ahead of time, that the gap between “can’t do this” and “can” is now measured in months, not years.

What Anthropic Actually Tested

Strip away the framing and this is a capability test, not a sighting. Anthropic’s Frontier Red Team — the group inside the company whose entire job is to find out what Claude and other frontier systems could do in the worst reasonable hands before anyone else does — ran a set of small open models (Anthropic’s report names Qwen3.5-9B, GLM-5.2, Gemma4-26B-A4B, and Llama3.1-8B among them) through the individual chores a self-replicating system would need: scanning a network for unfamiliar devices, figuring out what those devices are, connecting them together, and getting an AI model’s weights running on hardware that was never meant to host one.

Two experiments stand out. In the first, a model handled distributed inference across 15 cheap, off-brand Android TV boxes — BleepingComputer and other outlets covering the report put the hardware cost at roughly $55 a box, which is the detail that should actually worry people more than the AI part. That’s not specialized equipment. That’s whatever’s sitting in a drawer at a big-box electronics store. In the second, researchers tested whether any of the small open models could fully self-replicate — copying their own weights, node to node — across a small network of eight emulated devices. GLM-5.2 was the only one that pulled off the full chain end to end, reaching all eight nodes in four of five trials and seven of eight in the fifth. Anthropic calls that “end to end replication” in the simplified version of the problem. Simplified is the operative word. These were controlled setups built to isolate the capability, not a worm someone found crawling across the open internet.

What Would an AI Worm Actually Need to Do?

Anthropic’s report breaks self-replication down into a chain of steps, and a true “worm” only exists once a model can run the whole chain, unsupervised, on its own:

1. Find a target. Scan a network and identify internet-connected devices it hasn’t infected yet.
2. Get a foothold. Gain enough access to the device to run code on it.
3. Set up the environment. Install or configure whatever’s needed to run an AI model on hardware that wasn’t built for it.
4. Transfer itself. Copy its own model weights onto the new device.
5. Resume operating. Start running on the new device, then repeat the cycle from there.

Anthropic’s finding is that today’s small models can already do most of these steps individually and reliably. What breaks is the chaining — getting a model to execute all five steps back to back, without a human restarting it between stages, across device after device, indefinitely. That’s the gap Anthropic says is closing fast.

What Is an ‘AI Worm,’ Exactly?

An AI worm, in Anthropic’s framing, is an AI agent that autonomously copies its own model weights onto new internet-connected devices and keeps running there — spreading computer-worm-style, except what’s replicating isn’t just malicious code, it’s a functioning model that can keep making decisions on each new device it reaches. Gizmodo described the concept as closer to a digital slime mold than a traditional virus, feeding across whatever hardware it can reach rather than targeting one system.

Why This Matters

The thing that makes this worth taking seriously isn’t the smart-oven headline, fun as it is. It’s the shutdown problem. A conventional piece of malware living in a data center has an address — a server, an account, a cloud provider that can pull the plug. Anthropic’s report makes the structural point directly: a successful AI worm living across thousands of smart TVs, routers, and security cameras in people’s homes has no such address. As the report puts it, a replicator like this would be “challenging to shut down,” because “there’s no centralized point to shut off.” You can’t unplug the internet. You’d be chasing a population of devices owned by millions of different people, most of whom have no idea their smart TV box is even capable of hosting an AI model, let alone that it’s doing so.

The reason IoT devices specifically are the worry, and not phones or laptops, is unglamorous: security on cheap connected hardware is often an afterthought. Default passwords that never get changed. Firmware that never gets patched. Years of quiet botnet history (Mirai and its many descendants) already proved that a huge, permanently-online population of underprotected smart devices is an attacker’s dream. Anthropic’s finding is that the next version of that dream doesn’t need a human botnet operator at all — just a model capable enough to run the whole chain itself.

It’s also worth being precise about what Anthropic isn’t claiming. The company explicitly says no fully rogue replicator exists today. This is a projection built off a trend line — small models have been getting better at these component tasks at a measurable rate, and Anthropic extrapolated that rate forward to the point where the last gap (reliable end-to-end chaining) likely closes. “Likely by the end of 2026” is a forecast, not an observation, and forecasts built on current trend lines are exactly the kind of thing that can be wrong in either direction. Anthropic has an obvious incentive to sound the alarm early — it’s the same lab that restricted its own Claude Mythos model family from general release over vulnerability-finding capability, and the same lab that disclosed a Yemen-based weapons cell using Claude for missile guidance work a month before this report. A pattern of “we found something concerning in our own systems and we’re telling you” is now basically Anthropic’s house style.

The Bigger Picture

Zoom out and this fits the same shape as everything else Anthropic has published in the back half of this year: find the risk before it’s a headline you don’t control, publish the finding with real technical detail, and let the caveats do some of the work. Euronews’ coverage and The Hacker News’ writeup both lead with the scary framing — AI botnets, self-propagating models — because that framing is accurate as far as it goes. What gets lost in the social-media version of this story is that Anthropic also published detection ideas alongside the warning: a worm has to generate network traffic to spread, and the same report notes that traffic shows up as an anomaly to ISP-level flow monitoring, with a real tradeoff between how fast a worm replicates and how visible it becomes while doing it. Faster spread, more noise. Anthropic isn’t just raising an alarm; it’s handing defenders a starting point.

That’s a meaningfully different posture than, say, Anthropic’s September threat intelligence report on Russian and Chinese state-linked misuse, which documented attacks that had already happened. This report documents a capability gap that hasn’t been exploited by anyone yet, as far as Anthropic or anyone else has found. If you’re trying to track how seriously the industry takes AI misuse this year, the honest read is that labs are now publishing pre-mortems, not just post-mortems, for the risks they think are coming. Whether that’s reassuring or alarming mostly depends on how much you trust the forecast.

What Are Your Options Now

If you manage IoT devices, security cameras, or smart-home products at scale, this is a vendor-risk conversation to start now, not after an incident. Firmware update cadence and default-credential policy matter more after this report than they did before it, because the exploit surface it describes — cheap, poorly maintained, always-online hardware — is exactly what most consumer and small-business IoT fleets look like today.

If you’re a security team evaluating AI-related risk for 2027 planning, add “autonomous self-propagation across edge devices” to the same watchlist as the compartmentalized-request evasion tactics Anthropic documented in the Yemen missile case. Both are examples of a capability that doesn’t look dangerous task-by-task but becomes dangerous once it’s chained together without human checkpoints in between. Our guide to AI safety for business covers how to build vendor and infrastructure questions around exactly this kind of chained-capability risk, not just single-prompt misuse.

If you’re a regular reader of smart-home and IoT news wondering whether to worry today, the honest answer is no — not today. Anthropic found no rogue replicator in the wild, and this report describes a simplified, researcher-controlled test, not an active threat. The realistic near-term move is the boring one: keep smart-device firmware updated and change default passwords, the same advice that’s been true since the first consumer IoT botnets years ago. It just now comes with a deadline attached.

Our Take

We think Anthropic is right to publish this, and we think the “months away” framing getting picked up across tech press is doing more work than the underlying research supports. Anthropic found that small models can do most of the individual steps of self-replication and extrapolated a trend line to say the last gap probably closes by the end of 2026. That’s a genuinely useful early warning. It is not the same claim as “an AI worm is coming this year,” and several of the headlines built around this report blur that line more than Anthropic’s own paper does.

What we’d flag as the detail actually worth remembering: the shutdown problem is the real story here, more than the self-replication mechanics. A model that can copy itself step by step is a capability question with a fairly clear timeline attached. A model that’s copied itself across thousands of devices owned by people who have no idea it’s there, with no central kill switch, is a containment question with no clear answer at all. Anthropic’s report is honest that it doesn’t have one either — it offers detection ideas, not a fix. That’s the gap to watch, not the parameter count.

Frequently Asked Questions

Has an AI worm actually been found spreading in the wild?

No. Anthropic’s report is explicit that no fully rogue, self-replicating AI system exists today. The findings come from controlled experiments the Frontier Red Team ran itself, not from an observed real-world incident.

What size of AI model can already do parts of self-replication?

Anthropic found that models with roughly 30 billion parameters or fewer — small by frontier standards — can already perform many of the individual steps involved, including network scanning and setting up an environment to run a model on new hardware. They still struggle to chain every step together reliably without human intervention.

Why would smart ovens and Android TV boxes be targets instead of data centers?

Because they’re numerous, often poorly secured, and don’t require the kind of access or infrastructure a data center does. Consumer IoT devices frequently run outdated firmware and default credentials, the same weaknesses that have fueled traditional IoT botnets like Mirai for years, which makes them a plausible host for a self-replicating model rather than a theoretical one.

Why does Anthropic say an AI worm would be hard to shut down?

Because there would be no centralized point of control. A worm distributed across thousands of individually owned smart devices doesn’t have a single server or account that can be disabled — shutting it down would mean reaching every infected device individually, something no single entity is positioned to do quickly.

When does Anthropic think full self-replication capability could arrive?

Anthropic estimates that if small models continue improving at their current historical rate, they could match the capability level demonstrated in its simplified experiments by the end of 2026. That’s a projection based on a trend line, not a confirmed date.

What is Anthropic’s Frontier Red Team?

It’s the internal Anthropic group responsible for testing what Claude and other frontier AI systems are capable of in misuse scenarios, before those capabilities become public problems. The same team’s work sits behind several of Anthropic’s other 2026 safety disclosures.

Does this report mean I should stop using smart home devices?

No. Anthropic found no active threat — this is a capability projection, not an ongoing attack. The practical response is the same baseline hygiene security researchers have recommended for years: keep device firmware updated, change default passwords, and avoid exposing unnecessary device ports to the open internet.

---

Last updated: October 15, 2026. Sources: Anthropic — AI models may be capable of self-replicating without access to a datacenter · The Hacker News — Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets · BleepingComputer — Anthropic warns self-replicating AI could spread to your smart devices · Euronews — Anthropic warns AI will soon self-replicate and spread beyond data centres · Gizmodo — AI Could Soon Feed On Smart Devices Like a ‘Digital Slime Mold,’ Anthropic Warns.

Related reading: Claude Helped Yemen Build a Missile. It Failed. · Claude Filed a Fake Murder Tip. Cops Are Furious · Anthropic Bans Cruelty to Claude. Here’s the Catch · Anthropic’s Claude Mythos: Too Dangerous to Release · AI Safety for Business: What Leaders Need to Know