AI worms on connected devices: Anthropic's red team says the risk is near

On October 12, 2026, Anthropic's red team, which is tasked with assessing the dangerous capabilities of AI models, published a study signed by William Zhou and Daniel Freeman. According to the authors, small AI models could be just months away from being able to replicate themselves on consumer connected devices, such as low-end Android TV boxes. No worm of this kind has been observed in the wild: the results come from tests in a controlled environment.

What was tested

The researchers examine a specific scenario: a “worm” that compromises a device, installs its own weights (the model file) on it and uses them to attack the next devices. They focused mainly on installing the model on the infected machine. The intrusion step, by contrast, was simplified.

• A 9-billion-parameter model managed to get an AI model running on 8 of the 9 types of hardware tested.
• The tests took place in a closed network of 8 Android emulators whose ADB debugging port was open without authentication. Only GLM-5.2, among the open-weight models tested, completed the full cycle: it reached all 8 machines in 4 of 5 trials, and 7 in the fifth. The other models failed.
• The Gemma4-26B-A4B model was split across 15 TV boxes costing about $55 each, with a throughput of roughly 0.3 to 0.39 tokens per second.

The authors extrapolated the progress of small models (up to 30 billion parameters) as measured by the Epoch AI capabilities index. They conclude that a small model would reach GLM-5.2's level by the end of 2026, if the pace observed so far continues.

Limitations to keep in mind

The study acknowledges its own weaknesses. The intrusion was trivial, so the success rates represent a ceiling rather than a realistic measure. Replication would be slow: installing a model would take roughly 28 to 150 hours depending on the model. The timeline rests on extrapolating a general capabilities indicator. Finally, this is a research post published by the company itself, and no independent evaluation of it is known at this stage. Anthropic develops closed models, which compete with the open models tested in the study: this is context worth keeping in mind.

What should be done?

Defensive measures are mostly a matter of standard Internet of Things hygiene, already valid against botnets (networks of infected machines) such as Mirai:

• never expose devices' debugging or administration interfaces (ADB in particular) on the network;
• isolate connected devices on a separate network and change default passwords;
• monitor for unusual transfers of several gigabytes and sustained traffic between devices, two warning signs cited by the authors.

The researchers also call on manufacturers to ship safe default settings, and on internet service providers to quarantine subscribers whose devices are infected.