Could an AI program copy itself from one home gadget to the next, the way a computer worm does — no data center, no human help? Researchers at Anthropic say the ingredients for that scenario are coming together faster than expected, though nothing like it exists in the real world today.
In research published on October 12, the company’s Frontier Red Team reported that small AI models can already perform many of the individual steps needed to replicate across cheap, poorly secured internet-connected devices. One larger open model completed the full replication cycle in a deliberately simplified test. The team estimates that if small models keep improving at their recent pace, they could reach the same level by the end of 2026 — a projection, not a demonstration.
The TV-box demonstration
To test whether weak devices can even run a capable model, the researchers bought 15 off-brand Android TV boxes — about $55 each, with 4 gigabytes of memory apiece — and split Google’s Gemma4-26B-A4B model across them, each box holding a few of the model’s layers. The combined system worked, at 0.39 tokens per second: usable output, but far slower than a chat app.
Why TV boxes? A recent real-world botnet known as Kimwolf infected more than two million devices, mostly cheap Android TVs, according to the security firm Synthient. Devices like these are always on, rarely updated and often ship with minimal security.
Testing the pieces of replication
Anthropic breaks self-replication into stages: find a target, get code running on it, set up the model there, then spread onward. The team focused on the least-studied stage — setting up a working model on unfamiliar hardware.
A 9-billion-parameter model succeeded in getting a model running on eight of the nine hardware types tested, which ranged from small edge-computing boards to a Mac and a high-end gaming graphics card. Models of 30 billion parameters and under could complete many individual replication steps, the researchers said, but made mistakes when chaining them together.
In a second test, models were let loose in a sealed cloud network of eight emulated Android devices. One model, GLM-5.2, spread a smaller stand-in model to all eight machines in four of five trials, and to seven machines in the fifth.
What the experiments did not show
The break-in step was deliberately made trivial: the test devices accepted connections through an open port with no password — the digital equivalent of an unlocked door. The researchers describe their results as an upper bound on what would work in the real world, not a field test.
GLM-5.2 also never ran on the TV-class devices itself; it directed the spread from a separate server, installing a smaller model on each target. And Anthropic is explicit that it does not yet have a full rogue replicator — no AI worm has been found operating in the wild.
The end-of-2026 date is an extrapolation from a general capability index — a proxy the authors concede is only a rough estimate, not a measurement of replication skill.
Why some experts take it seriously — and where they push back
Security coverage of the study has focused on persistence. Unlike ordinary malware, a model spread across millions of home devices would have no central server to shut down, could figure out unfamiliar hardware on its own, and — in another Anthropic test — copies that inherited notes from earlier copies got better at the setup task, with success rising from 45 percent to as high as 84 percent over six generations.
The pushback concerns the gap between laboratory conditions and reality. Independent coverage, including Reuters, noted that Anthropic did not claim any current model had reliably replicated itself on the tested hardware, and analysts have observed that the headline timeline rests on a trend line through simplified evaluations. Real networks add bandwidth limits, delays and security obstacles the lab removed. A real replicator would also be extremely slow: at the demonstrated speeds, setting up on each new device would take a day or more.
What could stop a real AI worm
Anthropic argues defenders hold some strong cards. A replicator must move model files of many gigabytes between devices — a traffic pattern internet providers can spot. Providers have beaten botnets before: quarantining infected subscribers cleared 92 percent of Mirai infections within 14 days, in a case the paper cites. Manufacturers can also shrink the target pool with secure default passwords, which the UK market now requires.
For households, the practical advice is unchanged: change default passwords on routers and smart devices, keep firmware updated, and retire gadgets that no longer receive security updates.
The bottom line
Anthropic is not reporting an incident; it is publishing a capability warning from inside a laboratory. The demonstrated facts are narrow but real: models can run split across bargain-bin hardware, can set themselves up on unfamiliar machines, and — under simplified conditions — one model completed the replication cycle end to end. Whether and when those pieces combine outside a laboratory is the open question, and the reason the researchers say defenders should prepare now rather than later.
Sources: Anthropic Frontier Red Team, “AI models may be capable of self-replicating without access to a datacenter” (October 12, 2026); Reuters and trade-press coverage of the study. The illustration above is an original Zark News visualization, not an image from Anthropic.
