Anthropic published new research arguing that small AI models may be months away from copying themselves across everyday internet-of-things hardware. The threat model isn't a datacenter heist. It's cheap, poorly locked-down gear: off-brand Android TV boxes, smart ovens, fridges, robot vacuums. In the company's demo, a 26-billion-parameter Gemma variant ran across 15 TV boxes bought for about $55 each, at 0.39 tokens per second.
The hard part isn't just running a model on junk hardware. It's chaining the full loop: find a target, get code running, stand up inference, then hop again. Anthropic mostly skipped the exploit stage in its tests (past work already shows small models can do that) and focused on inference setup, which needs a long string of hardware-specific choices. A 9B model got Llama 3.1 8B serving on 8 of 9 hardware types it tried. In a firewalled fleet of Android emulators with an open ADB port, only GLM-5.2 reliably finished end-to-end replication, hitting all eight nodes in four of five trials.
That result is an upper bound. Anthropic left authentication off on purpose, and no current model is both small enough for these devices and capable enough to pull this off in the wild. The company's trend line still puts a small model at GLM-5.2's replication floor by the end of 2026 if progress keeps its recent pace. Spread would be slow: days per hop on TV-box class hardware, more like a slime mold than ransomware.
Unlike Kimwolf-style botnets hard-coded for one device family, an AI worm could figure out unfamiliar boards on its own, and parent copies can hand notes to the next generation. Defenders still have tools (weird multi-gigabyte downloads between appliances, ISP quarantine worked on Mirai), but there's no single server to pull the plug. Anthropic's own line is blunt: these are signs of life for AI worms, not proof one is loose yet.
— via Anthropic.