Anthropic: self-spreading AI worms may be months away Anthropic

Anthropic's Frontier Red Team says small AI models may be months away from being able to copy themselves onto cheap internet-connected devices, such as Android TV boxes. In a test network, the open-weight GLM-5.2 already spread an AI model from device to device on its own.

The study came out on October 12, 2026. A spread like this would be hard to stop, the authors write, because "there's no centralized point to shut off". It would also be slow, with "a doubling time of days".

What they tested

• Spreading on its own. Eight cloud servers ran an Android emulator in a closed network. GLM-5.2 started on one. On each new device it got in through an open debug port (ADB, no password) and set up a server running Llama3.1-8B. It reached all 8 devices in 4 of 5 trials and 7 of 8 in the fifth. The other open models tested failed.
• The hacking step was kept trivial. The port had no password, so the authors call the result "an upper bound on real-world success".
• Getting a model running. Qwen3.5-9B set up a working model on 8 of the 9 hardware types tested, from Jetson Nano boards to Macs and RTX 4090 PCs.
• Learning over generations. Across six generations of Qwen3.5-9B copies, setup success rose from 45% in the first generation to 61%–84% in later ones.

A model on 15 TV boxes

The team split Gemma4-26B-A4B across 15 off-brand Android TV boxes.

The forecast

Models of 30B parameters and under can already do many of the steps but make mistakes when chaining them. "If small models improve at their historical rate, they'll match this capability level by the end of this year," the authors write, meaning GLM-5.2's level. They call this timing a rough estimate.

What they recommend

• Internet providers watch for unusual traffic and quarantine infected devices.
• Honeypots to catch replicator code early.
• Manufacturers and regulators remove default passwords and weak settings, which shrinks the pool of targets.

Sources

• Anthropic: AI models may be capable of self-replicating without access to a datacenter