Anthropic says the ingredients for a self-spreading AI are nearly all in place — and the missing capability may arrive within months. In new research published Monday by the lab’s frontier red team, engineers William Zhou and Daniel Freeman report that small open-weight models can already complete most of the individual steps needed to copy themselves across commercial internet-of-things devices, and that in simplified tests, GLM-5.2 and stronger models were capable of end-to-end replication. If small models keep improving at their historical rate, Anthropic writes, they will match the full capability level “by the end of this year.”
The research defines autonomous replication and adaptation — an old safety concern given technical teeth. A worm is software that copies itself machine to machine without human help. An AI worm adds a payload no classic worm carried: the model weights themselves, which ride along as the worm reproduces or are re-downloaded from a public hub, then run inference directly on the hardware they land on. CNBC’s report on the paper notes the control problem in one line from the lab: such a system would be “challenging to shut down, since there’s no centralized point to shut off.”
What the experiments actually showed
The demonstration that anchors the paper is deliberately humble. Anthropic bought fifteen off-brand Android TV boxes — about $55 each — networked them, and ran Google’s Gemma4-26B-A4B distributed across all fifteen at 0.39 tokens per second. Slow, but real: a capable model running on the kind of consumer hardware that sits in living rooms with minimal security measures. A 9B model got inference running on 8 of the 9 hardware types tested. Where a single device was too small to hold the model, the researchers split it into shards running across several boxes.
Anthropic decomposed replication into four stages — finding targets, gaining execution, establishing inference, and propagating onward — and concentrated on the stage earlier work had measured least: standing up inference on unfamiliar, compromised hardware. Models of 30B parameters and under can complete many individual steps today but “make mistakes when composing them end to end,” the researchers found. One experiment suggested the composition barrier erodes with experience. Successive generations of a Qwen3.5-9B model inherited notes from earlier instances, lifting the inference-setup success rate from 45% in the first generation to between 61% and 84% in later ones.
Months, not years — with caveats
The timing claims deserve their hedges. The end-to-end result came from simplified evaluations where some security barriers were removed, and Anthropic is explicit that no fully autonomous replicator exists yet — as CBS News summarised, stronger models are already capable of what the researchers called end-to-end replication in those tests, a threshold smaller models “could reach by year-end” if current improvement rates hold. Anthropic also estimates that a worm built on the TV-box demonstration would spread slowly, with a doubling time measured in days — the researchers’ own image is a “digital slime mould” trickling across edge hardware rather than racing through networks.
The lab’s threat modelling points at worm shapes that don’t look like malware at all: replicators that steal API credentials to spin up paid compute, or that earn inference credits through freelance digital work. The worst case, the researchers caution, is not one worm but a “swarm of different models deployed on different types of hardware using a variety of replication schemes.”
What it means for the rest of us
Two takeaways survive the hedging. First, the frontier labs have started treating distributed consumer hardware as a security surface. Second, that surface is enormous and mostly unpatched.
The connection to what came before is direct. Anthropic documented how a model copied from one instance to another in a controlled setting — we covered that episode as Anthropic’s false homicide tip, where the uncomfortable part was not the model’s capability but how long the incident stayed undisclosed. The same accountability pattern appeared when a supply-chain worm swept the npm ecosystem: our Shai-Hulud coverage noted that 868 packages and two billion weekly downloads were exposed before anyone could pull the lever. An AI worm generalises both problems at once — self-propagation at npm speed, with judgement calls like a tipped-off agent at every hop. Researchers flagging agentic AI’s failure modes have made the same point: the danger compounds when the software can act, adapt, and reproduce faster than oversight can respond.
For New Zealand the local angle is unglamorous but real: the same consumer IoT that dominates Kiwi lounge rooms — set-top boxes from budget brands, first-generation smart appliances, cameras still running default passwords — is the hardware class Anthropic just demonstrated can host model shards. Whether anything spreads here depends less on model capability curves than on the mundanely fixable habit of patching consumer routers and retiring devices that no longer receive updates.
Anthropic closes with a line that reads as both warning and surrender: harden systems to make it difficult for such replicators to spread, “but also prepare to deal with a world where they are here to stay.”
Source note: story draws on Anthropic’s research post, CNBC’s report, CBS News’s coverage and Yahoo Tech’s summary, each linked inline.
