Could AI Worms Take Over Your Smart Devices?

Anthropic's Frontier Red Team demonstrated that a 753 billion parameter model, GLM-5.2, autonomously replicated itself across all 8 nodes of a sealed Google Cloud network in 4 of 5 trials (reaching 7 of 8 in the fifth), while all other tested models failed the full task. In a separate test, the team sharded Google's 4-bit quantized Gemma 4 26B across 15 off-brand Android TV boxes costing about $55 each with 4 GB of RAM, running at 0.39 tokens per second. The researchers deliberately exposed Android Debug Bridge ports without passwords and ran the agent's reasoning on a separate server, and the agent installed Llama 3.1 8B as a payload proxy rather than a copy of its own model.

The unsettling claim: a worm with an AI brain Could an AI agent autonomously locate vulnerable devices, install its software, and perpetually spread without human intervention? This question underpins recent research into self-replicating AI worms , which combines two critical capabilities. Such a worm would require a model small enough to run on inexpensive hardware and an agent intelligent enough to adapt and install it across diverse systems. Anthropic’s Frontier Red Team recently explored these components, not a fully realized, autonomous worm akin to Skynet from The The Terminator . Their work dissects pieces of this complex scenario, rigorously testing individual requirements rather than presenting an already functional, real-world threat. This careful distinction is crucial for understanding the research's implications. Researchers investigated whether an AI model could be sharded across 15 off-brand Android TV boxes , each costing around $55 and possessing only 4 GB of RAM . They successfully ran Google’s Gemma4-26B-A4B, a 4-bit quantized model, by partitioning its layers, albeit at a slow 0.39 tokens per second . This demonstrated the feasibility of distributed inference on low-cost hardware. Separately, Anthropic tested an AI agent’s ability to propagate. In a closed network of 8 Google Cloud Platform nodes , GLM-5.2 https://www.stork.ai/en/glm-5-2 , a 753 billion parameter model, achieved autonomous replication in 4 out of 5 trials. However, the target devices had their Android Debug Bridge ADB ports deliberately exposed, simplifying the "hacking" step to focus on the installation challenge. Fifteen TV boxes ran one painfully slow model Anthropic’s initial hardware demonstration involved networking 15 off-brand Android TV boxes , each costing approximately $55. These devices, common in homes, offered limited computational power with roughly 4 GB of RAM per unit. No single box could run a substantial AI model. Researchers addressed this constraint by implementing model sharding . They used Google’s Gemma 4 26B model, quantized to 4-bit, and distributed its layers across the networked devices. Each TV box processed only a few layers, passing intermediate computations sequentially to the next device. This approach successfully ran the model, demonstrating that even low-cost, distributed hardware can collectively host a sophisticated AI. However, the performance was notably slow: the system generated responses at 0.39 tokens per second, translating to about one short sentence per minute. This speed highlights a critical trade-off, making it a proof-of-concept rather than a practical high-speed AI service. One model spread—but the experiment had a catch Anthropic then shifted to a separate test for the “worm” component: an AI agent's ability to self-replicate. Researchers established a sealed network of eight Google Cloud machines, each running Android, and launched the agent on one node. Its task: locate other machines, copy its software, and initiate a model. One model, GLM-5.2 , successfully completed this loop across all eight machines in four of five trials, and seven of eight in the remaining trial. All other tested models failed the full task. This demonstrated an AI's capacity to autonomously spread and establish a functional model. However, critical caveats accompany this result. For one, researchers deliberately configured the machines with open Android Debug Bridge ADB access and no password, simplifying the initial compromise step. Moreover, the agent’s own large-model reasoning ran on a separate, powerful server, not on the target machines themselves. Crucially, the agent did not install a copy of its own “brain” on the target devices. Instead, its objective was to install Llama 3.1 8B https://www.stork.ai/en/llama-3 , a smaller model, which acted as a proxy for the type of payload a real worm might carry. For more details on the underlying research, see AI models may be capable of self-replicating without access to a datacenter - Anthropic https://www.anthropic.com/research/self-replicating-ai . These conditions highlight that while autonomous spread was achieved, it relied on a significantly simplified environment compared to real-world threats. Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking Real risk, or a leap from proof to panic? Autonomous replication remains a theoretical threat, not an imminent one. The model that demonstrated self-spreading, GLM 5.2 , boasts 753 billion parameters—far too large for a typical Android TV box. Conversely, models small enough for those devices could not complete the replication task. The capabilities simply do not yet overlap. Android TV boxes are, however, vulnerable. The Kimwolf botnet has already infected over 2 million such devices, many shipped with exposed ADB debug ports and no password by default. While the replication test used deliberately open ports, this real-world precedent shows that such entry points are not imaginary. Moving multi-gigabyte model weights between devices would be both conspicuous and slow. A 9-billion-parameter worm, for example, would need 28 to 51 hours to install a model on each new device. This slowness would give network defenders ample opportunity to detect and mitigate the spread. Anthropic projects that small models could gain these combined capabilities by late 2026, but this remains an estimate, not a certainty. While the research highlights a potential future risk, it does not provide evidence of an imminent mass infection. The debate continues: real risk, or a leap from proof to panic? Frequently Asked Questions Can AI models currently replicate themselves across smart devices? Anthropic’s tests did not demonstrate a complete, independent worm on real smart devices. The model capable of coordinating the test was too large to run on the target devices. What did Anthropic’s self-replicating AI experiment test? Researchers separately tested running a model across low-cost Android TV boxes and an AI agent’s ability to install a model on networked Android machines. Why were the test conditions criticized? The target machines had unauthenticated Android Debug Bridge ports exposed, and the agent used a separate server for its reasoning. Why are cheap Android TV boxes a security concern? Some ship with insecure defaults, including exposed debugging ports. Researchers have linked such devices to large botnets, including Kimwolf.