Imagine a computer virus that not only transfers itself to another device, but can also learn how to make itself work there. Even if the device has entirely different hardware or software. That’s the sort of threat experts at Anthropic have been studying, and their results indicate it may not be as far off as we’d like to think.
Anthropic warned in October 2026 that smaller AI models could soon be able to replicate across everyday connected devices. The findings raise some major questions about what AI worms might mean for cybersecurity. But how much of this has been demonstrated, and how much is still a prediction? The answer is a little more complicated than the headlines suggest.
What Is an AI Worm?
An AI worm is a kind of self-replicating software that uses artificial intelligence to help it spread across computers or other networked devices. It could replicate itself from machine to machine, like a classic computer worm, without requiring someone to install it each time. The difference is how it handles unfamiliar systems.
Standard worms usually follow instructions written by their creators. They could try to find a known weakness, exploit it and then install another copy of themselves. An AI worm might be able to figure out how to deal with different hardware, operating systems and software setups as it goes along.
It might also contain its own AI model weights, the numbers that determine how a trained model works. Those weights would essentially be part of the malware itself, allowing the model to run on the next compromised device. Of course, getting onto another computer is only half the problem.
The AI also has to get itself going there and keep on spreading. This is where Anthropic's research gets interesting.
What Did Anthropic Discover About Self-Replicating AI?
On 12 October 2026, Anthropic’s Frontier Red Team presented research into autonomous AI replication, examining whether AI models could get themselves running on unfamiliar hardware before repeating the process across multiple devices.
The researchers said replication breaks down into four steps: identifying another device, gaining access, setting up the AI model and continuing the spread. The third stage, inference setup, was their main focus. Inference is what a trained AI model does when it runs and gives an answer or executes a task.
Getting it running on new hardware can mean finding appropriate software, installing packages and solving technical issues. That’s a lot for an AI model to figure out on its own. However, Anthropic discovered that a nine-billion-parameter model was able to establish inference successfully on eight of the nine hardware types examined.
Parameters are the values a model learns during training, and the number of parameters gives us a general idea of the size of a model. The scientists then looked at whether models could go through the entire replication process on a controlled network of eight simulated Android devices. One model, GLM-5.2, reached all eight targets in four out of five trials.
However, the experiment was conducted with deliberately simplified access requirements, and the larger model ran on separate computing infrastructure. Smaller models, with 30 billion parameters or fewer, could do separate tasks but struggled to consistently put all the pieces together.
Anthropic expects that by the end of 2026, advances could allow smaller models to achieve the required capability. Of course, that's a prediction based on where things are going, not evidence that an AI worm is about to spread across real-world networks.
Why Could IoT Devices Make AI Worms More Dangerous?
When we think of powerful AI, we tend to imagine huge data centres with expensive computer equipment. But Anthropic’s findings suggest AI worms might not need anything quite so powerful. The researchers managed to run a 26-billion-parameter model across 15 cheap Android TV boxes that cost roughly $55 apiece.
The model wasn't very quick at all, at just 0.39 tokens per second. However, it did show that a bunch of low-power devices could work together to run a bigger AI model. This is known as distributed inference. Instead of running everything on one system, several devices each handle a different part of the model.
The concern for cybersecurity specialists is what may happen if infected devices work together like this. As we’ve seen, connected devices are susceptible to attack. According to research by Infoblox into the Kimwolf botnet in January 2026, nearly 25 per cent of its cloud customers had made DNS queries associated with Kimwolf activity.
Those queries indicated network probing, not verified infections. Nevertheless, they demonstrated how activity involving compromised consumer devices and proxy services might reach enterprise networks. An AI worm that can run on similar hardware might be harder to contain, especially if copies keep running independently across different networks.
Are AI Worms a Real Cybersecurity Threat Yet?
So, should organisations be worried about AI worms at the moment? There's reason to pay attention, but the research doesn't indicate that autonomous AI worms are currently spreading throughout the internet. Anthropic demonstrated that models can solve many of the technical issues involved in replication.
It also showed that a capable enough model could successfully complete a simplified replication process. What it hasn't shown is a small model reliably infecting unfamiliar real-world devices, running itself on their hardware and continuing to spread. Similar capabilities are being investigated at the UK AI Security Institute.
Its Frontier AI Trends Report indicated that success rates on selected self-replication evaluations rose from about five per cent to more than 60 per cent between 2023 and 2025. But these were controlled experiments that tested particular abilities, like obtaining computing resources and maintaining access.
They weren't demonstrations of AI worms replicating themselves across real-world networks. The institute also found that models had trouble with several of the later stages of replication and were unlikely to succeed under real-world conditions at the time. Another important consideration is how quickly an AI worm might spread.
Anthropic predicts smaller, device-based replicators could spread relatively slowly, potentially taking days to double their reach. That could give security teams time to spot suspicious activity. But it would also mean watching for a threat that might spread gradually, rather than one that would announce itself through a rapid outbreak.
How Can Enterprises Prepare for AI Worms?
There’s no need to create an entirely new cybersecurity plan to address a threat that hasn’t yet been observed in the wild. But Anthropic's findings give businesses a useful reason to explore whether their existing security controls would be able to recognise the activities involved in AI replication.
Identify devices capable of running AI
Look beyond servers, laptops and other devices that are already included in typical IT inventories. Security cameras, conferencing devices, industrial gateways and other connected devices may have enough computing power to run smaller AI models or contribute to distributed inference.
Organisations need to know what devices are connected, what software can run on them and whether anyone is monitoring them. Otherwise, unusual computing activity might go unnoticed simply because no one would have expected those devices to be doing much computing in the first place.
Limit opportunities for replication
An AI worm would still have to get onto another device and run software on it. Network segmentation can limit which systems connected devices can communicate with. Strong credentials, restricted software installation and disabling unnecessary services can help make unauthorised access harder.
Whether the malware in question is AI-enabled or not, the goal is to stop one infected device from becoming an easy entry point into many others.
Monitor for unusual AI-related activity
Anthropic lists a number of behaviours that could help defenders identify a potential replicator, including unexpected model transfers and unusual communication between devices. Security teams may also look for unfamiliar inference processes, repeated attempts to connect to other systems and unexpected changes in device computing activity.
None of these signals proves an AI worm is present. But combined, they could help identify software that's running in a way that doesn't match the intended use of a device.
Prepare for distributed containment
In traditional incident response, the emphasis is usually on finding an infected machine, removing the malware and closing the vulnerability that allowed it in. If copies were already running across different networks, a decentralised AI worm might make that more complicated.
Organisations should assess whether they can quickly isolate affected devices, investigate related systems and coordinate remediation without having to shut down one central server. The issue isn't necessarily stopping a single, very powerful AI model. It’s tracking down all the places that model, or a copy of it, might still be running.
Final Thoughts: AI Worms Are an Emerging Risk, Not an Established Threat
While the technology isn't quite there yet for small AI worms to reliably spread across real-world devices, it's worth taking Anthropic's warning seriously. The research suggests AI models are improving at overcoming the technical problems involved in replication.
What's less clear is how quickly those capabilities will advance and whether they can reliably work together outside controlled experiments. For companies, the sensible response is to assess where connected devices could offer opportunities for unauthorised AI execution and whether existing security controls could detect it.
As these capabilities develop, EM360Tech will continue to look at the research and cybersecurity developments that help organisations understand emerging risks before they become established threats.
Comments ( 0 )