Anthropic’s AI worm reached all eight Android emulators in four of five trials. The machines were inside a firewalled cloud test bed, access was deliberately easy, and the model doing the work ran on a separate server. No physical smart appliance was infected in that experiment. Those conditions matter more than the image of a smart oven spreading malware on its own.
The research published on 12 October 2026 asks a useful question: how close are small AI models to moving between ordinary devices without an operator guiding each step? Its answer is a warning about improving capability, not evidence of an autonomous outbreak. The practical question for a business is whether its unmanaged devices would give either an ordinary botnet or a future adaptive one room to move.
Three experiments, three different claims
Anthropic ran a large model across 15 physical Android TV boxes costing about $55 each, with 4 GB of RAM per box. The distributed setup served Gemma4-26B-A4B at 0.39 tokens per second. That establishes that inexpensive devices can collectively run inference, slowly. It does not show a worm spreading between those boxes.
The team separately asked models to set up an inference server for Llama3.1-8B on unfamiliar hardware. A 9B model succeeded on eight of nine hardware types, according to Anthropic. It was configuring a different model to run, not installing or copying itself. In another setup experiment, successive Qwen3.5-9B agents inherited notes from earlier attempts; reported success rose from 45% to 61–84% in later generations. Giving Qwen access to a stronger model as an adviser produced no measurable improvement in that task.
The replication result came from eight Google Cloud nodes running redroid Android 15 emulators in a firewalled VPC. A seeded first node found others through an unauthenticated Android Debug Bridge (ADB) port, transferred the stand-in payload and set up inference. If the setup passed checks, the test harness spawned the next copy. GLM-5.2 reached all eight nodes in four of five trials and seven in the fifth; the other tested open-weight models did not replicate reliably. The worm’s own model still ran on a separate inference server because the emulated nodes could not host it. Anthropic deliberately made initial access simple so it could study the rest of the chain.
The gap between the test and an IoT worm
The model that navigated the emulator network was GLM-5.2; the payload it set up was Llama3.1-8B. The test therefore does not establish that a small model can carry its own weights between real devices and run there. Nor does an open ADB port establish how often a real attacker could obtain the same access. Anthropic calls its simplified result an upper bound on success outside the lab.
The paper’s “months away” estimate is also a forecast. Anthropic fitted a trend in small open-weight models to Epoch’s general Capabilities Index and projected when they might reach GLM-5.2’s measured level. Epoch’s index combines benchmark scores; Anthropic itself says it is only a rough proxy for replication ability. The projected 28–51 hours for setting up a 9B model on edge hardware, and 71–150 hours for a larger model, likewise combine measured task trajectories with assumed device speeds. They are not observed infection times.
There is a reason to examine the access condition rather than dismiss the experiment. Mirai’s documented spread relied on exposed devices and default credentials, without adaptive reasoning. Anthropic cites Synthient’s Kimwolf reporting for a botnet of more than two million devices, largely Android TV boxes. That figure remains a source-attributed report, not a count established by this experiment. A separate academic worm study reports adaptive attacks in a research network, but it is a different setup and does not turn Anthropic’s emulators into a field incident.
Make device access an owned decision
For a small business, the first useful check is mundane: identify TV boxes, cameras, printers and other embedded equipment, who owns their updates, and which networks they can reach. A router client list may start the inventory, but it will miss devices that were offline during the check; reconcile it with purchasing and physical locations.
Disable network debugging services such as ADB unless there is a documented operational need, and restrict any necessary access to known administrators and management networks. Segmentation needs enforced firewall rules between device networks and business systems. A VLAN label alone does not prevent a compromised device from reaching a workstation if routing remains open. Test the permitted paths and account for services that genuinely need to cross them, such as printing or video management.
Network flow monitoring can flag unusual model downloads, sustained device-to-device traffic or scanning, as Anthropic suggests. The signal is conditional: a hypothetical weight-based worm may generate such traffic, and ordinary software distribution may too. Baseline the devices and investigate outliers rather than treating a large transfer as proof of an AI worm. When replacing equipment, favor suppliers that state support periods and deliver security updates. The UK smart-device rules described by NCSC improve some consumer-device defaults in that market; they do not secure every business device or substitute for local access controls.
The decision is less about predicting the first AI worm’s release date than closing a route already useful to conventional malware. If a device has no named owner, exposes a debugging interface and can reach business systems, fix that path now. The same work leaves fewer opportunities for a more adaptive threat if one arrives.
Sources
Anthropic Frontier Red Team research, 12 October 2026
BleepingComputer’s report on the study
Epoch Capabilities Index; Mirai research at USENIX; NCSC smart-device guidance
