Anthropic researchers say small AI models may be approaching the ability to spread between vulnerable internet-connected devices without relying on data-center hardware.
Their October 12 research outlines a potential cybersecurity risk, but it does not show an AI worm spreading across the public internet or taking control of devices in the wild.
The distinction matters: the researchers demonstrated parts of a possible attack chain in controlled tests, then projected how model capabilities could develop. Anthropic’s research says some small models can already complete individual replication tasks, while end-to-end success depends on simplified conditions.
What Anthropic tested
The research focused on whether models could set up AI inference on unfamiliar hardware and connect the steps needed to move from one machine to another.
In one test, a 9-billion-parameter model got inference running on eight of nine hardware types. In a separate experiment, Anthropic used a firewalled fleet of emulated Android devices.
The test network included an unauthenticated ADB port, which made it easier for a model to move between machines.
Only GLM-5.2 completed the full replication task reliably in that evaluation. Anthropic notes that the experiment simplified the cyber-exploit step and describes the result as an upper bound on real-world success.
The company also ran a 26-billion-parameter model across 15 inexpensive Android TV boxes, showing that consumer hardware can share the work of running a model, albeit slowly.
These are important demonstrations of technical feasibility under specific conditions. They are not evidence that a complete, autonomous AI worm has been released or is currently spreading across real-world devices.
How an AI worm could differ from conventional malware
Traditional botnets often target a narrow set of devices or known vulnerabilities. Anthropic’s concern is that an AI-enabled program could adapt its setup process to unfamiliar hardware and software, potentially widening the range of devices it could target.
A compromised network of low-cost devices might run model pieces across multiple machines.
That would not necessarily make the system fast: Anthropic estimates that replication could take days, and its experiments found significant limits on speed and reliability.
The researchers also describe other possible routes, such as stealing credentials to pay for cloud inference. These scenarios are hypotheses in the report, not outcomes demonstrated in the experiments.
Why the forecast remains uncertain
Anthropic projects that smaller models could reach the tested capability level by the end of 2026 if progress continues at the historical rate used in its analysis. That is a forecast based on an extrapolation, not a confirmed deadline.
There are practical hurdles between a lab test and a real-world outbreak. A worm would need to gain access to devices, run reliably on varied systems, avoid detection, and continue spreading despite security measures and remediation.
The test’s unauthenticated access path does not establish how often a comparable weakness would be available on real devices.
So the research supports a narrower conclusion: models are improving at tasks that could contribute to autonomous replication, and some elements have been demonstrated in controlled settings. The timing, likelihood, scale, and persistence of a real incident remain uncertain.
What device makers and network operators can do
Anthropic’s report points to defenses that also help against conventional botnets: secure default settings, stronger device protections, and better monitoring for unusual network activity.
Large model downloads and unexpected device-to-device traffic could provide signals for network operators to investigate.
For device manufacturers, the practical work includes shipping secure configurations, supporting software updates, and reducing the number of devices exposed through weak defaults.
For network providers, monitoring and quarantine procedures can help contain infections if suspicious activity is detected.
The broader lesson is that AI changes the adaptability of a potential attacker, while many of the useful defenses remain familiar cybersecurity practices.
What to watch next
The most useful evidence will come from evaluations that test replication on real, diverse devices with realistic security controls.
Researchers should also report how often systems succeed, what assumptions the tests rely on, and whether defenders can detect and contain the activity.
Anthropic’s work is an early warning based partly on controlled demonstrations and partly on projections.
It deserves serious technical attention, while headlines about AI taking over the internet should be read as speculation rather than a description of what has already happened.
