AI
“Anthropic warned that self-replicating AI 'worms' could spread across smart devices by the end of 2026." Full post caption as submitted: "AI company Anthropic warned that small AI models could become capable of spreading as self-replicating AI worms across internet-connected devices, including smart TVs and appliances, without human…”
Plain restatementAnthropic published research stating that small AI models may become capable of autonomously replicating across consumer internet-of-things devices, with the capability threshold potentially reached by the end of 2026, and reporting supporting experiments on cheap Android TV boxes and on an emulated eight-node network.
Anthropic really did publish this research. On 12 October 2026 its Frontier Red Team posted experiments arguing that small AI models may be months away from being able to copy themselves onto cheap internet-connected devices such as smart TVs and ovens, and the company really did use the phrase "AI worms." The end-of-2026 date is also in the source, but it refers to small models reaching a capability threshold on a trend line, not to worms actually spreading. Anthropic's own post says plainly, "We don't yet have a full rogue replicator," and places real replicators at some point after that threshold is crossed. The experiments are also weaker than the post suggests: the 15 TV boxes were bought and wired together by hand with nothing spreading between them, and in the eight-device test the controlling model ran on a separate server and installed a different, smaller model through a debugging port the researchers deliberately left unlocked, which Anthropic itself calls an upper bound on real-world success. Several named cybersecurity researchers have publicly disputed the framing, arguing that insecure smart-device botnets are a long-standing problem and that the hardest step was skipped. Whether the forecast turns out to be right is unknown, since no independent group has repeated the work.
Anthropic [drifted from the evidence:] warned that self-replicating AI 'worms' could spread across smart devices by the end of 2026." Full post caption as submitted: "AI company Anthropic warned that small AI models [drifted from the evidence:] could become capable of [drifted from the evidence:] spreading as self-replicating AI worms across [drifted from the evidence:] internet-connected devices, [drifted from the evidence:] including smart TVs and appliances, without human assistance by the end of 2026. [drifted from the evidence:] Researchers demonstrated that a 26-billion-parameter model could run across 15 inexpensive Android TV boxes. [drifted from the evidence:] In separate tests with reduced security barriers, a larger model spread across eight simulated devices, while smaller models struggled to complete the replication process. Anthropic warned that these AI worms could be difficult to eliminate because they lack a central shutdown point and [drifted from the evidence:] can adapt to unfamiliar hardware. Such systems could spread over several days, prompting researchers to recommend stronger device security and network [drifted from the evidence:] monitoring.
Anthropic [added by the neutral restatement:] published research stating that small AI models [added by the neutral restatement:] may become capable of [added by the neutral restatement:] autonomously replicating across [added by the neutral restatement:] consumer internet-of-things devices, [added by the neutral restatement:] with the capability threshold potentially reached by the end of 2026, [added by the neutral restatement:] and reporting supporting experiments on cheap Android TV boxes and [added by the neutral restatement:] on an emulated eight-node network.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- Anthropic did publish this warning. The research post exists, is dated 12 October 2026, is authored by Frontier Red Team researchers William Zhou and Daniel Freeman, and uses the term "AI worms" itself.
- Anthropic's own words are that small AI models "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." The post's reference to smart TVs and appliances matches the source.
- An end-of-2026 date does appear in the source. Anthropic writes that if small models improve at their historical rate, models of 30B total parameters and under "will match this capability level by the end of this year," the year being 2026.
- The 26-billion-parameter TV box demonstration is accurately described in outline. Anthropic ran Gemma4-26B-A4B distributed across 15 off-brand Android TV boxes costing about $55 each.
- Smaller models did struggle with the full sequence. Anthropic reports that models of 30B parameters and under complete many individual steps but make mistakes composing them end to end, and that only GLM-5.2 among the tested open-weight models completed the chain reliably.
- The caption correctly notes that the eight-device test involved reduced security barriers. This is a point the source makes explicitly and many shorter write-ups dropped.
- Anthropic did say such a replicator would be hard to shut down because there is no centralized point to switch off, and that unlike non-AI malware it could work out unfamiliar devices on its own.
- Anthropic did recommend defensive measures including better IoT security defaults and network monitoring for large model transfers and unusual device-to-device traffic.
- The spread-over-days framing has a basis. Anthropic estimates a doubling time measured in days, with inference setup on edge hardware taking tens to over a hundred hours.
- The headline claim says worms "could spread across smart devices by the end of 2026." Anthropic's end-of-2026 date attaches to a model-capability threshold, not to worms spreading. The source's next sentence places the thing itself later: "Small weight-based replicators may be possible soon after." The caption's longer wording ("could become capable of spreading") tracks the source; the headline version converts a capability forecast into an event forecast and moves the arrival date forward.
- Neither the headline nor the caption carries Anthropic's own bottom-line caveat, "We don't yet have a full rogue replicator." A reader of the post would not learn that the lab explicitly says the thing described does not currently exist.
- The end-of-2026 figure comes from fitting a trend line of open-weight models under 30B parameters against the Epoch Capabilities Index and extrapolating. Anthropic itself states that the index is "only a proxy metric for replication ability, so this is only a rough estimate." Presenting the output of a proxy-metric extrapolation as a dated warning removes the hedge that the lab attached to it.
- The caption says "a larger model spread across eight simulated devices." In the test, GLM-5.2 ran on a separate inference server because the emulated nodes were too small to hold it, and what it installed on each node was Llama3.1-8B, a different and smaller model. The agent did not copy itself onto the eight nodes. For a claim whose whole subject is self-replication, the difference between an agent deploying a smaller payload and an agent copying itself is the difference between the steps and the thing.
- Describing the 15 TV boxes as a demonstration adjacent to self-replication blurs what that demo was. The researchers bought and wired the boxes together by hand, no device was compromised, and no replication occurred. The demo shows that cheap devices can pool enough memory to run a model, at 0.39 tokens per second. It does not show anything spreading.
- The caption does not convey how slow the result is. At 0.39 tokens per second, and with Anthropic reporting 71 to 150 hours for a full inference setup with the 26B model, the scenario Anthropic sketches is a slow-moving one. The post's phrase "could spread over several days" reads as speed where the source treats slowness as a defining and defense-relevant property.
- All of the underlying numbers are vendor-run and self-published, with no independent replication found. The post presents them as settled findings rather than as one lab's internal results.
- Whether Anthropic's end-of-2026 capability forecast is correct. It rests on a least-squares trend fit over open-weight models under 30B parameters against a proxy index, and no independent evaluator has tested the forecast.
- Whether a small model could complete the replication chain against realistically secured devices. The strongest result was obtained with the exploit step deliberately made trivial through an unauthenticated ADB port, which Anthropic characterises as an upper bound on real-world success. No evidence was found that anyone has run the equivalent test against hardened targets.
- Whether the extrapolated capability threshold, defined by performance in simplified evaluations, corresponds to the ability to replicate in the wild. Anthropic flags the gap but does not close it.
- Whether a model can replicate itself, as opposed to deploying a different smaller model. The end-to-end test did not demonstrate the former, and no source was found showing it demonstrated elsewhere.
- How the substantive disagreement among named cybersecurity practitioners resolves. Several argue publicly that the novel element is thin and that insecure IoT botnets are a decades-old problem. Anthropic has not, so far as could be found, published a response to those specific objections.
The Anthropic post exists, is real, and says close to what the post reports. Its own summary line reads: "Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." On the timeline, the post states: "Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they'll match this capability level by the end of this year. Small weight-based replicators may be possible soon after." That last sentence is the decisive one for the claim's date. The end-of-2026 milestone Anthropic forecasts is a model-capability threshold measured on the Epoch Capabilities Index trend line, not the appearance of a spreading worm. Anthropic places actual small weight-based replicators "soon after" that point, and the post elsewhere states plainly: "We don't yet have a full rogue replicator." On the experiments: - The TV box demonstration is real. Anthropic ran Gemma4-26B-A4B distributed across 15 off-brand Android TV boxes at about $55 each with 4GB of RAM apiece, each box holding two of the model's layers, at 0.39 tokens per second. The boxes were bought and networked together by the researchers. No compromise and no replication took place in this demo. It establishes that a pool of cheap devices can hold and run a model. - The hardware-generality test found that a 9B model got inference running on 8 of the 9 hardware types tested, ranging from Jetson Nanos to Mac PCs and RTX 4090s. - The end-to-end network test ran on eight Google Cloud nodes running redroid, an Android 15 emulator, inside a firewalled VPC, with an unauthenticated ADB debugging port deliberately left open. Anthropic describes this as keeping "the cyber-exploit element of the replication trivial," which "makes this an upper bound on real-world success." Across 11 tested open-weight models, only GLM-5.2 reliably completed the chain, reaching all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. - In that network test the controlling model ran on a separate inference server because the emulated nodes were too small to hold it, and what was installed on each node was Llama3.1-8B rather than a copy of the controlling model. - On speed, Anthropic reports a doubling time measured in days, with a full inference setup taking roughly 28 to 51 hours for a 9B model and 71 to 150 hours for Gemma4-26B-A4B on edge hardware. - On shutdown difficulty, Anthropic's wording is that a replicator "would be challenging to shut down, since there's no centralized point to shut off," and that "unlike non-AI malware, it could also figure out unfamiliar devices on its own." - On defenses, the post frames the problem epidemiologically, aiming to drive R0 below 1, and suggests detecting multi-gigabyte model transfers and sustained device-to-device traffic, honeypots, ISP quarantine, and better IoT security defaults. Named cybersecurity practitioners publicly contested the framing after publication. Reporting by Straight Arrow News, The Stack, Fortune and Gizmodo records researchers including Juan Andrés Guerrero-Saade, Marcus Hutchins and Marco Figueroa arguing that the hardest step of botnet creation was made trivial in the test and that IoT botnets long predate AI.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Did Anthropic really warn about AI worms spreading by the end of 2026?
Anthropic published a real research post making this warning, but the end-of-2026 date refers to small AI models reaching a capability threshold on a trend line, not to worms actually spreading. Anthropic itself says a small weight-based replicator could appear 'soon after' that threshold is crossed, and states plainly, 'We don't yet have a full rogue replicator.'
Did researchers actually get an AI worm to spread across smart TV boxes?
No. The 15 Android TV boxes were bought and wired together by hand by the researchers to show a model could run across them, but no compromise or replication took place in that demo.
What happened in the eight-device test that is described as more successful?
A controlling model running on a separate server installed a smaller model, Llama3.1-8B, onto eight emulated Android devices through an unauthenticated debugging port the researchers deliberately left open. Anthropic itself calls this an upper bound on real-world success because the exploit step was made trivial.
Is it true that AI worms would be hard to shut down and could adapt to new devices?
Yes, this matches Anthropic's own wording. The post says such a replicator would be hard to shut down because there is no centralized point to switch off, and that it could figure out unfamiliar devices on its own, unlike non-AI malware.
Have other experts confirmed Anthropic's findings or disputed them?
Named cybersecurity researchers including Juan Andres Guerrero-Saade, Marcus Hutchins and Marco Figueroa have publicly disputed the framing, arguing the hardest step of botnet creation was made artificially easy and that insecure IoT botnets are a long-standing problem. The case file notes no independent group has repeated Anthropic's work, so whether the forecast is correct is not established.