Could a $55 Android TV box become part of a network that powers a self-replicating AI worm? On October 12, 2026, Anthropic’s Frontier Red Team researchers William Zhou and Daniel Freeman published experiments on autonomous AI replication that examined whether small AI models could operate on inexpensive consumer devices and handle the technical steps needed to spread across unfamiliar hardware.
Although Anthropic has not demonstrated a fully autonomous AI worm, its research shows progress in capabilities that could support one. These include configuring inference software on unfamiliar devices and passing lessons from failed attempts to subsequent model instances.
Cheap hardware can already run the models
Anthropic ran Gemma4-26B-A4B, a 26-billion-parameter model, across 15 Android TV boxes priced at roughly $55 each. The devices collectively provided enough computing power to run the model at approximately 0.39 tokens per second, although the test did not involve compromising devices or autonomous replication.
In another experiment, a 9-billion-parameter model successfully configured inference software on eight of nine hardware types. The result suggests that smaller models can already perform some of the setup tasks needed to operate across different devices.
Since hardware configurations vary, an AI worm may encounter unfamiliar software requirements or installation procedures as it spreads. A model capable of diagnosing and resolving these issues could potentially infect device types its developer had not specifically programmed it to support.
Anthropic simplified the replication test
Anthropic also tested whether AI models could complete a simplified replication process across eight cloud-hosted Android nodes. GLM-5.2 was the only open-weight model tested that completed the process reliably, reaching all eight nodes in four of five trials and seven nodes in the fifth.
However, GLM-5.2 did not copy itself onto the devices. Instead, it configured them to run Llama3.1-8B, while GLM-5.2 operated separately. The evaluation also launched a new agent instance after each successful setup, so the process was not fully autonomous.
The findings suggest that a smaller model with capabilities comparable to GLM-5.2 might eventually replicate independently. Anthropic has yet to demonstrate a model small enough to run on inexpensive consumer hardware that can complete the entire process on its own.
The test also made device access easier by exposing an unauthenticated Android Debug Bridge (ADB) port. As a result, Anthropic considers the findings an upper estimate of real-world success, since an actual AI worm would have to gain access to devices with different security restrictions.
Why Anthropic expects small models to improve by late 2026
AI models with 30 billion parameters or fewer can already perform individual replication tasks, but most cannot complete the entire process consistently.
Anthropic estimates that small models could match GLM-5.2's general capabilities by the end of 2026, based on historical improvements tracked by the Epoch Capabilities Index. However, the index measures overall model performance rather than autonomous replication, so the projection cannot reliably predict when smaller models will be capable of replicating independently.
The findings build on earlier research into autonomous replication and adaptation, or ARA, which investigated whether AI agents could obtain resources, create copies of themselves, and adapt to unfamiliar situations.
For cybersecurity teams, the remaining uncertainty is whether these capabilities will work consistently across devices with different software configurations and security protections. Anthropic's controlled experiments demonstrate progress, but they do not establish how successfully an AI worm could replicate across protected systems.
A failed attempt could help the next copy
Anthropic examined whether successive instances of Qwen3.5-9B could improve their inference setup performance by inheriting notes from previous attempts. The first generation achieved a 45% success rate, which increased to between 61% and 84% in later generations. These improvements occurred even though the model’s underlying weights did not change.
The results suggest that an AI worm could learn from failed installations by passing information between copies. For example, if one instance encountered a configuration error, the next could use the recorded information to try a different command or avoid the same problem.
Traditional worms and botnets can identify device characteristics and execute predefined instructions. A reasoning model could potentially devise its own troubleshooting steps based on the software and system conditions it encounters.
For incident responders, this could make malware behavior harder to anticipate. Even after security teams identify an attempted infection method, later copies might adopt different approaches based on information collected during previous attempts.
Slow replication can still create persistence
Under Anthropic’s Android TV box assumptions, a network comparable to the Kimwolf botnet, which has more than two million devices, would deliver inference capacity equivalent to roughly 40 H100 GPUs. Individual replication could also take more than a day, which would limit how quickly an AI worm could spread.
However, slow propagation would not necessarily make an infection easy to eliminate. If compromised devices ran models locally, shutting down a central inference service would not stop them. Defenders would instead have to locate infected devices and remove the malware from each one.
Transferring large model files between devices could generate detectable network traffic, giving security teams an opportunity to interrupt replication. Restricting access to debugging interfaces could also prevent some infection attempts.
Anthropic has not demonstrated an AI worm capable of independently compromising and replicating across consumer devices. Its findings indicate that inexpensive hardware can already run small models, while more capable systems can perform portions of the replication process. Whether a single small model can combine these capabilities and overcome real-world security restrictions remains unproven.
