{"slug": "friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons", "title": "Friction Was the Safeguard: AI Worms, AI-Ported Games and Bioweapons", "summary": "Anthropic's Frontier Red Team reported on October 12 that small AI models may be only months away from self-replicating across cheap connected home devices, after running a 26-billion-parameter model across 15 generic Android TV boxes bought for about $55 each at 0.39 tokens per second and testing whether an AI could find, enter and set up a model on another device on a separate network of eight emulated Android devices. The post, titled \"AI models may be capable of self-replicating without access to a datacenter,\" warns such a replicator could be hard to shut down. The finding lands alongside a Kotaku report by Lewis Parker on October 9 that hundreds of AI-decompiled games and emulators, including browser-playable Halo: CE, GTA: Vice City and The Simpsons: Hit & Run, appeared in a couple of weeks, a surge Parker attributes to Claude Opus 5.5's decompiling ability.", "body_md": "[Field Notes](https://macanorak.com/tag/field-notes/)\n\n# Everything Everywhere All at Once\n\nSelf-replicating AI, bioweapons research and AI-ported games share one problem: friction is eroding.\n\nIn the wonderfully chaotic film that gives this article its title, a harried laundromat owner called Evelyn is pulled into a multiverse of every single life she might have lived. The apparent villain turns out to be a version of her own daughter, whose mind has fractured after experiencing all those possibilities at once, leading her to conclude that nothing matters. The film's answer to this brand of nihilism is to be kind, especially when you don't know what's going on, and to pay attention to what's in front of you.\n\nThe temptation with AI at the moment is to react by panicking, or shrugging. Neither, to my mind, seems quite right.\n\nOn Friday October 9th, Lewis Parker, at [Kotaku](https://kotaku.com/we-might-be-cooked-as-these-vibe-coded-web-browser-ports-of-halo-the-simpsons-hit-and-run-and-gta-vice-city-seem-to-work-perfectly-2000743300?ref=macanorak.com), reported that anyone can now open a browser tab and play *Halo: CE* with no download or console; or *GTA: Vice City* or *The Simpsons: Hit & Run*, which Parker noted can target 240fps. One of the four *Halo* ports he tried even had working online servers, with a low ping. According to Parker, hundreds of AI-decompiled games and emulators have appeared in a couple of weeks, a surge he attributes to Claude Opus 5.5 being exceptionally good at decompiling.\n\nParker’s reaction was broadly the same as mine — the lawyers may send cease-and-desist letters, but then what? Anyone who made one can make another.\n\nSo much of what has kept the world tidy wasn't a lock or even necessarily the law. *Friction* was very often the safeguard. In the case of the games, work that once took skilled people many months can be tackled by leaving an AI coding model running overnight.\n\nLess friction doesn't automatically mean more harm, of course — making something easier isn't the same as making it dangerous. It just means more people will give it a go, and more attempts means more things that can go wrong. At scale, even a small fraction is a lot, and whether anything does go wrong depends on what else is in the way.\n\nSo the pressing question, to my mind, is what happens when something that was technically possible but practically difficult becomes easy enough to do at scale? AI can remove so much of the cost, effort and expertise that used to make such things impractical. A few stories recently have given me the uneasy feeling that multiple points of friction are dissolving everywhere all at once.\n\nOn Monday October 12th, Anthropic's Frontier Red Team published a post titled *[AI models may be capable of self-replicating without access to a datacenter](https://www.anthropic.com/research/self-replicating-ai?ref=macanorak.com)*. A worm is a program that copies itself from machine to machine without any human intervention. Earlier [research](https://arxiv.org/abs/2606.03811?ref=macanorak.com) showed AI agents doing something similar across a cluster of high-end chips, and Anthropic wanted to know whether a model could live on something much more ordinary.\n\nThe team ran two separate tests. In the first, they bought 15 generic Android TV boxes at about $55 each, wired them together and ran a 26-billion-parameter model across them. It managed a painfully slow 0.39 tokens per second, but it worked. In the second, they asked whether an AI could do the work of spreading: find another device, get inside it, set up an AI model there, and carry on. They ran that test on a separate contained network of eight emulated Android devices, not on the real TV boxes.\n\nTheir conclusion is that small models may only be months away from being capable enough to replicate across cheap connected devices that are common in many homes — smart ovens, fridges, TV boxes, and the like. Such a replicator could be hard to shut down because there would be no single central point to switch off (although it would spread slowly with a doubling time measured in days). When software misbehaves, the standard response is to find where it's running and turn it off. A replicator spread across thousands of poorly secured devices has no single \"where\".\n\nReassuringly, the researchers haven't built a worm in the wild, and they say so. In the second test, they made the hacking step easy — the emulated devices had an unlocked debugging port. In real life, getting in would be harder, though as they point out, past botnets spread by little more than guessing factory-default passwords. The [Kimwolf](https://cyberscoop.com/kimwolf-aisuru-botnet-lumen-technologies/?ref=macanorak.com) botnet spread through an unlocked debugging door of exactly this kind, and many of the TV boxes it infected left the factory with that door open, and some arrived with suspect software already installed.\n\nOnly one of the open-weight models Anthropic tested, called GLM-5.2, managed the whole chain in this simplified test. It had to set up a smaller, different model on each device, rather than copy itself. So the researchers’ reasoning is that a small model with GLM-5.2’s abilities could, in principle, do the same for itself. The prediction that small models will get to this point in months comes from extending the historical rate at which they've been improving. Anthropic estimates they could reach the required level by the end of this year, with small-model replicators potentially following soon after.[\\[1\\]](#fn1)\n\nUsing their assumptions, a swarm the size of Kimwolf (which infected more than 2 million devices) would do the work of about 40 top-of-the-range AI chips, at most, for this particular model. That's small fry next to a datacenter. Anthropic compared such a replicator to a “*digital slime mold*”, which, by the way, is a wonderfully evocative phrase — slow, scattered, and potentially very hard to get rid of.\n\nIt does of course matter who's feeding us this information. This is a safety team at an AI company publishing research that is two things at once — a warning and a demonstration of how seriously they take safety. That doesn't make it wrong but it deserves the same scepticism I tried to bring to the [\"hoax, psyop, or product launch?\"](https://macanorak.com/ai-safety-hoax-psyop-or-product-launch/) question.\n\nBiology is another place where friction is being put to the test. This week Sir Ken McCallum, head of the UK security service, MI5, warned in his annual speech on threats to the nation that AI could \"*change the stakes*\" on bioweapons. [The Guardian](https://www.theguardian.com/technology/2026/oct/14/could-ai-change-the-stakes-in-the-development-of-bioweapons?ref=macanorak.com) quotes experts who say the immediate concern is well-resourced organisations / states where AI could amplify expertise that already exists. The other risk comes from rogue groups working out of garage laboratories, although here the friction is considerable. Information is only one part of the problem. Tacit know-how, materials, equipment, testing and delivery all remain substantial barriers. As one researcher put it about nuclear weapons: plans are the easy part, but where do you get the uranium?\n\nIn September, Anthropic published a report on misuse of its models, covered by the [BBC](https://www.bbc.co.uk/news/articles/cx2zrrpkx20o?ref=macanorak.com). It described five cases of scientists in unnamed countries using Claude for work that may have been dangerous, alongside Russia-linked cyber espionage and an Iranian propaganda operation. In one case, Anthropic says researchers used the chatbot to plan experiments intended to make a highly pathogenic bird flu virus adapt and spread more easily in mammals. (These were reports of potentially dangerous uses, not evidence that anyone had built a biological weapon.)\n\nThe rub, here, is that some of this work has legitimate uses. Similar experiments are conducted to understand how viruses might evolve and to prepare for future pandemics, which makes intent hard to judge from the research alone. One red flag was that after being blocked, the scientists found workarounds. It banned the accounts.[\\[2\\]](#fn2)\n\nThat's a point of friction — a provider saw a pattern and blocked the accounts. But how firmly will that hold? [Professor Tom Inglesby](https://www.theguardian.com/technology/2026/oct/14/could-ai-change-the-stakes-in-the-development-of-bioweapons?ref=macanorak.com), director of the Johns Hopkins Center for Health Security, says that most AI companies aren't saying what they're doing, and that no country has formal government policies specifically addressing this kind of misuse. Even the DNA synthesis companies that screen orders do so largely voluntarily, and AI-designed sequences could slip past checks that aren't looking for them.\n\nAll of this only works if somebody is watching, which means hosted models. Provider-side monitoring can't protect anything running beyond the provider's view, such as a local model. That's the scenario Anthropic's replication research is about: a model on the cheap TV box in someone's home sending no activity logs back to the company that made it, and the company telling us about its guardrails is the company that sells the product.\n\nIf nobody can be fully relied upon to hold the line, what's left? Mostly, it's quite pedestrian. Anthropic's list of defences reads almost like a household checklist.\n\n- Internet providers can monitor for unusual traffic. To spread an AI worm would have to move enormous files (the worm itself can be several gigabytes) between gadgets that normally never communicate at that volume. A replicator spreading at scale would leave detectable traces and the faster it spreads the more ‘noise’ it makes.\n- When a provider identifies an infected device it can quarantine that customer's connection, restricting what it can reach and directing the user towards instructions for cleaning things up.\n- Defenders can leave decoy gadgets online, known as ‘honeypots’, to be infected on purpose. Once a replicator takes the bait they can capture a copy and study how it works.\n- Earlier botnets including [Mirai](https://www.radware.com/security/ddos-knowledge-center/ddospedia/mirai/?ref=macanorak.com) spread by exploiting weak security on connected devices. Since April 2024 UK rules have[prohibited manufacturers](https://www.ncsc.gov.uk/blog-post/smart-devices-law?ref=macanorak.com) from supplying consumer smart devices with easily guessable universal default passwords. Older devices can still need attention though, so keeping their software up-to-date is important.\n\nThe aim, in epidemic terms, is to suppress the number of new infections caused by each infected device below one so the whole thing dies out.\n\nBack to the games, then. The lawyers are another point of friction. [Another Kotaku piece](https://kotaku.com/activision-and-bethesda-crackdown-on-genai-mw2-and-fallout-projects-2000739580?ref=macanorak.com) reports that Activision and Bethesda have taken action against some of the AI-built projects, but takedown notices land on individual projects, not the technology, and Kotaku observes that publishers haven't gone after the AI companies themselves. Parker compared the coming game of whack-a-mole to the pirated DVD era — it’s slow and it never quite finishes, rather like the digital slime mold.[\\[3\\]](#fn3)\n\nAnthropic ends its replication research with a sentence that could apply to all the stories in this piece. We should harden our systems, it says, *\"but also prepare to deal with a world where they are here to stay.\"* That isn't the language of an off-switch.\n\nIn *Everything Everywhere All at Once*, the nearest thing to an off-switch is a bagel-shaped black hole that could end the multiverse. Evelyn nearly follows the villain inside, then chooses kindness instead. The multiverse is never fixed. What changes is how she decides to live in it.\n\nFor us, that means patching routers, changing default passwords and encouraging internet providers to notice anomalies. It also means asking who's watching the watchers, and not assuming that the people reporting the risks are either hoaxers or prophets. We don't know exactly what is coming — that isn't a reason to panic, or an excuse to shrug. <sup>[\\[4\\]](#fn4)</sup> But we do need to pay attention to what's in front of us.\n\nI'm going to check that my router isn't still using its default admin password, then dig out my old copy of *[The Simpsons: Hit & Run](https://en.wikipedia.org/wiki/The_Simpsons:_Hit_%26_Run?ref=macanorak.com)*.[\\[5\\]](#fn5)\n\n1. To be clear, that's an extrapolation from a capability benchmark, not a timetable established by a successful real-world worm. [↩︎](#fnref1)\n2. The cases involved older models, and [Anthropic says](https://www.anthropic.com/threat-intelligence-report-september-2026?ref=macanorak.com) its newest ones, including Claude Fable 5, have stronger safeguards on such queries.[↩︎](#fnref2)\n3. Not all of this friction was necessarily worth keeping. A 2023 [survey](https://zenodo.org/records/8161056?ref=macanorak.com) by the Video Game History Foundation found that only 13% of a sample of 1,500 classic US video games were still in commercial release, and preservationists argue that decompiling is one way to keep old games playable once publishers lose interest, as with the fan decompilation of*[Duke Nukem: Zero Hour](https://www.techreviewer.com/developer-news/2025-10-20-duke-nukem-zero-hours-revival-sparks-game-preservation-push/?ref=macanorak.com)* .[↩︎](#fnref3)\n4. Nor does it mean putting friction back everywhere. Some barriers kept dangerous things out, and others just kept people out. The skill is telling them apart. [↩︎](#fnref4)\n5. In *Hit & Run* , Homer follows a black van to Mr Burns's mansion and accuses him of spying on Springfield. Burns says the vans are just delivering pizzas. In actuality, Springfield is being monitored by swarms of mechanical wasp cameras, deployed by the aliens Kang and Kodos to film the town for their intergalactic reality show,*Foolish Earthlings* . The game opens with hundreds of their wasp cameras descending on Springfield, and Homer smashes one in his own home. Homer is right that something is watching Springfield, yet wrong about the identity and purpose of the watchers. He's neither hoaxer nor prophet.[↩︎](#fnref5)", "url": "https://wpnews.pro/news/friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons", "canonical_source": "https://macanorak.com/everything-everywhere-all-at-once/", "published_at": "2026-10-20 12:26:38+00:00", "updated_at": "2026-10-20 12:46:47.395363+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-research"], "entities": ["Anthropic", "Anthropic Frontier Red Team", "Kotaku", "Lewis Parker", "Halo: CE", "GTA: Vice City", "The Simpsons: Hit & Run", "Claude Opus 5.5"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons", "markdown": "https://wpnews.pro/news/friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons.md", "text": "https://wpnews.pro/news/friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons.txt", "jsonld": "https://wpnews.pro/news/friction-was-the-safeguard-ai-worms-ai-ported-games-and-bioweapons.jsonld"}}