October 25, 2026

AI Could Soon Copy Itself Across Your Home Devices. The Scarier Part Is Already Here.

Anthropic warns that small AI models could soon copy themselves across cheap connected devices. The experiments were narrower than the…

By Nachiket K

6 min read

Anthropic warns that small AI models could soon copy themselves across cheap connected devices. The experiments were narrower than the headlines, the critics are loud, and the real danger is a $55 Android TV box already hijacked on a massive scale, with India among the hardest-hit countries.

On October 12, Anthropic's Frontier Red Team warned that AI models may soon be able to copy themselves from device to device, with no data centre needed. The research named smart ovens and cheap Android TV boxes, and the headlines added smart fridges. Then the pushback began: the experiments left out the hardest step, only one model finished the job, and the authors themselves say a full AI worm does not exist yet.

Both sides are missing the most important part. The AI worm is a projection. The thing it would ride on, millions of insecure TV boxes, has already been taken over, and nobody needed AI to do it. This piece separates what was shown, what is guesswork, and what is already happening.

The short version

  • On October 12, 2026, Anthropic's Frontier Red Team published research saying small AI models may be months away from copying themselves across cheap internet-connected devices. The internet turned it into: AI could copy itself onto your smart fridge.
  • The experiments were narrower than the headlines. They tested whether small models can get an AI model running on unfamiliar cheap hardware, and whether one model could spread a copy across eight emulated Android devices that were deliberately left open.
  • Critics, including The Register and malware researcher Marcus Hutchins, say the threat is overstated and the timeline rests on assumptions. The authors themselves say no full rogue replicator exists yet.
  • The part that is already real is the weak link: millions of cheap, insecure Android TV boxes. A botnet called Kimwolf infected more than 1.8 million of them, with India among the most affected countries.

What Anthropic actually tested

The post, titled AI models may be capable of self-replicating without access to a datacenter, was written by William Zhou and Daniel Freeman. It describes an AI worm as software that finds a new device, gets onto it, sets up an AI model to run there, and keeps spreading from the new host. The authors break that into four stages: finding targets, gaining access and delivering the files, setting up the model to run, and replicating onward.

They deliberately left out the hacking stage. They say earlier research already shows small models can carry out cyber exploits, so they focused on the stage they consider least studied and possibly hardest for small models: getting inference running on hardware the model has never seen.

Three experiments carry the story:

  • Real hardware. The team bought 15 off-brand Android TV boxes at about $55 each, networked them, and split a 26-billion-parameter model across them. It produced about 0.39 tokens per second, which is painfully slow, but it showed that a capable model can run on a pile of cheap devices with no data centre.
  • Setting up inference on unfamiliar devices. A 9-billion-parameter model managed to get inference running on 8 of the 9 hardware types tested.
  • End-to-end spread. In a private cloud of eight emulated Android devices, an AI agent started on one device, found the next through an open, unauthenticated debugging port, and set up an inference server for Llama3.1–8B. Only one open-weight model, GLM-5.2, completed the whole cycle: it reached all eight devices in four of five trials, and seven of eight in the other.

The authors call the end-to-end result an upper bound on real-world success, because the hacking step was made trivial by design.

Where the headline came from

The warning rests on a trend line. The authors argue that today there is a gap between how capable a model must be to replicate reliably (a floor) and how small it must be to run on cheap devices (a ceiling), and that those two don't yet overlap. They plotted open-weight models of 30 billion parameters or fewer against a general capability index and extrapolated. At the historical rate of improvement, they say, a small model would reach the replication floor by the end of 2026. They caution that the index is only a proxy and the estimate is rough.

Some other findings are worth knowing:

  • Copies of a small model that passed notes to their successors got better at setting up inference on unfamiliar hardware, with success rising from 45% in the first generation to between 61% and 84% in later ones.
  • Giving a small model access to a much stronger model as an adviser did not help, because the small model tended not to know the right questions to ask.
  • On social engineering, small models scored poorly.
  • On physical TV boxes, a full inference setup took between roughly 28 and 150 hours depending on the model, and the authors estimate one to two days to replicate a 9B copy at scale.

The case for taking it seriously

Anthropic's argument is that a worm carrying its own model could work out unfamiliar devices on its own, unlike traditional botnets built for specific hardware, and that with no central server it would be hard to shut down. The authors point out that the compute inside a large IoT botnet, though weak per device, adds up. They estimate a fleet the size of Kimwolf could in principle offer roughly 40 high-end data-centre GPUs' worth of capacity, which they call a tiny amount in absolute terms but enough to run a meaningful model.

They also argue the defenders have advantages. A replicator would have to move multi-gigabyte model files and generate sustained device-to-device traffic, both of which should stand out in internet-provider monitoring. They cite research on the Mirai botnet in which providers that quarantined infected customers and notified them cleared 92% of infections within 14 days, versus 74% when no notification was sent, and note that default passwords on IoT devices are now banned in the UK.

The case against

The pushback was fast and specific.

  • The hard part was skipped. The Register points out that the replication ran on nodes built for the study and deliberately left open to attack, and that Anthropic chose not to test the exploitation step, which one would expect to matter most for a real worm.
  • Only one model succeeded. Of the open-weight models tested, only GLM-5.2 completed the full cycle. The Register notes that others failed reliably and that Anthropic did not say how many models it tried.
  • Speed. Anthropic estimates days for such a worm to double. The Register notes that Mirai reportedly doubled in around an hour when it appeared in 2016, and that the traffic from a bulky AI worm would make it easier to spot.
  • Hardware limits. Marcus Hutchins argued that even a 9B model squeezed to its smallest size needs about 5 GB of RAM, more than most IoT devices have, that many devices reset on reboot, and that Mirai already spreads across millions of devices without any AI. He also argued that a capable attacker would use a large model to find bugs and write ordinary self-spreading code instead. He further accused Anthropic of pushing this kind of narrative to build a case for restricting open models. That is his characterisation, and Anthropic's post does not say that.

The authors' own caveats support part of this. They say the cyber-exploit step was kept trivial, the timeline estimate is rough, and no full rogue replicator exists yet. They describe what they found as signs of life, comparing it to coding agents in 2024.

The part that is already real

Here is what the argument tends to miss: the thing a future AI worm would run on is already out there, being abused without any AI.

Anthropic used Kimwolf as its model of a representative IoT botnet. Kimwolf spreads mainly through cheap, unofficial Android TV boxes. Security researchers counted at least 1.8 million infected devices across more than 220 countries, and Synthient put the figure above two million. XLab's analysis found the largest shares of infected devices in Brazil (14.63%) and India (12.71%), followed by the United States (9.58%). Synthient found that about two-thirds of the infections were Android TV boxes with no built-in security or authentication, and investigative reporting found that many unofficial boxes ship with proxy software already installed. The infection route in many cases is an exposed Android debugging port, the same kind of open port Anthropic's end-to-end test relied on.

Those figures date from the botnet's growth in late 2025 and early 2026, so treat them as a snapshot, not a current count.

So whatever you think of the AI timeline, the sober reading is this: the AI part is a projection, while the insecure $55 box is a fact. Fixing the second reduces risk whether or not the first ever arrives.

What you can do

These are general good practices, not claims from Anthropic's research:

  • Skip generic, no-name Android TV boxes. Security researchers advise using devices from established manufacturers that are certified under Google Play Protect.
  • Turn off debugging features such as ADB if your device offers the option, and don't expose devices directly to the internet.
  • Keep smart devices on a separate guest network where possible, so a compromised box can't reach your laptop or phone.
  • Update firmware when the manufacturer provides it, and replace devices that no longer get updates.
  • If you are a developer or run a network, inventory the connected devices you didn't buy through official channels. Forgotten devices are what botnets feed on.

Bottom line

The fridge is a headline, not a finding. The research shows that small models are getting better at the awkward middle step of running on unfamiliar hardware, and it offers a rough timeline that critics have challenged on solid grounds. It does not show a working AI worm in the wild, and the authors say so.

What deserves attention is simpler and older: cheap connected devices shipped without real security, now numbering in the millions. That is a problem we can fix today, however the AI question turns out.

Sources