Does Self-Replicating AI Pose a Real Risk to Your Company Yet?

According to research published by Anthropic's Frontier Red Team on 12 October 2026, AI models of 30 billion parameters and under already complete the individual steps of self-replication but cannot yet carry out the full chain. In the simplified test, the only tested open-weight model to complete the full chain was the larger GLM-5.2, which itself ran on a separate server. The authors expect small models to reach that level by the end of 2026 if they keep improving at their historical rate, and self-replicating AI running on a small model could appear soon after.

The researchers describe such an AI-driven computer worm as running on cheap, poorly secured IoT devices such as smart ovens and Android TV boxes. It would spread slowly, with the number of infected devices doubling over days, but it would be hard to shut down because it has no central off switch.

What did Anthropic's researchers measure?

The researchers split replication into four steps: finding targets, gaining access and delivering the payload, setting up the model to run on the new device, and spreading further. Earlier studies had already shown that small models can handle the attack steps, so the research focused on inference, that is, running the model: the least measured step so far, and possibly the hardest for small models.

In the inference test, the models had to start a server serving the Llama3.1-8B model on unfamiliar hardware. The hardware included Nvidia Jetson Nano modules, Macs and RTX 4090 graphics cards, and a 9-billion-parameter model succeeded on 8 of the 9 hardware types.

The researchers also ran the 26-billion-parameter Gemma4-26B-A4B model on 15 Android TV boxes, each costing about $55 and carrying 4 GB of memory: every box held two of the model's layers, and the setup reached 0.39 tokens per second. By the authors' calculation, with 4 GB of memory and 4-bit quantization, a 9-billion-parameter model needs at least 4 boxes and a 26-billion-parameter model at least 10. This demo did not test replication.

The full chain was tested on an isolated network of 8 Google Cloud machines, each emulating Android 15. The worm had to reach the next machine through an ADB (Android Debug Bridge) port open without authentication and deploy a server running Llama3.1-8B there. When the server passed the checks, the researchers started the worm's next copy on it. Of the open-weight models tested, only GLM-5.2 completed the chain: in four of five trials it reached all 8 machines, and in one it reached 7. The other models failed consistently.

According to the authors, such a worm has to be capable enough to replicate reliably and small enough to fit on the devices it compromises. No model meets both conditions today. Among open-weight models of 30 billion parameters and under, the best at each point in time improved by 13.7 points a year on Epoch AI's Epoch Capabilities Index (ECI), and the authors' trend line puts a small model at GLM-5.2's level by the end of 2026.

What does the research not show yet?

The authors state that there is no full rogue replicator yet. In the test, access was deliberately easy: the ADB port accepted connections without authentication, so real-world success would be at most this high. The Mirai botnet, however, spread using a list of default usernames and passwords, so the researchers believe breaking into real IoT devices may not be much harder than the access step in the test.

GLM-5.2 itself ran on a separate server and deployed only the smaller Llama3.1-8B on the new machines. The authors infer that an 8-billion-parameter model with GLM-5.2's capability could also start itself, although newer small models may have more complex architectures. ECI is a general index combining results from more than 50 benchmarks, and it measures replication ability only indirectly, so the authors themselves treat the end-of-2026 date as a rough estimate. The spread calculation rests on a single hardware type and a single past botnet, and the researchers did not test how an AI botnet would respond to defenders.

The researchers' measurements therefore show that the steps already work individually and that a larger model completed the chain in a simplified environment. The end-of-2026 date and the spread rate are estimates, and the easy access was an assumption of the test.

How fast would such an AI worm spread?

The authors started from what they measured on real TV boxes: unoptimized, over a 32,000-token context window, Gemma4-26B-A4B runs at about 0.3 tokens per second, so a full inference setup would take 71–150 hours. Even a 9-billion-parameter model would need more than 1–2 days for each replication.

According to Synthient, the Kimwolf botnet infected more than 2 million devices, mostly Android TV boxes. If every group of 15 TV boxes in a fleet that size ran one copy of Gemma4-26B-A4B, the authors calculate that roughly 133,000 copies would result, together producing about 80,000 tokens per second. That equals at most about 40 Nvidia H100 GPUs, a small amount in absolute terms. The authors expect the compute built into devices to keep growing while the smallest model size needed for reliable replication falls.

The authors compare defense to epidemic control: the reproduction number (R₀), the average number of new devices each infected device infects, has to be pushed below 1 for the worm to die out. Defenders benefit from the traces the worm would leave on the network: newly infected devices would download several gigabytes of data, the model weights; distributed inference would cause unusually heavy, sustained traffic between devices; and spreading would involve scanning and many outbound connections. ISPs' flow monitoring would pick this up, and the faster the worm spreads, the more visible it becomes.

When the Mirai botnet was being cleaned up, an ISP quarantined infected subscribers and redirected their browsers to cleanup instructions. According to a 2019 study, this removed 92% of infections within 14 days, against 74% without notification. The authors believe quarantine would work similarly as a first defense against an AI worm, but eliminating it completely would take coordinated work by every affected ISP.

How would an AI worm differ from today's botnets?

Traditional botnets target one device type: Kimwolf, for example, attacked Android TVs and mobile devices. According to the authors, an AI botnet is not tied to any hardware or software and could infect machines beyond IoT devices. It does not need root privileges either: the software that runs the model works without them, and poorly secured devices can be re-infected after a restart.

The models can also learn as they spread. In the experiment, each new generation of Qwen3.5-9B received the previous generation's notes, and the setup success rate rose from 45% in the first generation to 61–84% in later ones. Advice from a frontier model did not help: Qwen3.5-9B did not improve measurably with access to Opus 4.8, because small models do not know what to ask. The authors therefore consider it more likely that a large model would direct the strategy and launch small models as subagents. Small models are weak at spear phishing, so the authors expect social engineering mainly from large models.

Which company devices and accounts could become targets?

According to the authors, these spread routes are the closest to being realized:

The first two columns are based on Anthropic's research.

According to the authors, most Jetson devices are not reachable from the internet. TV boxes are a different story: Synthient says they topped the list of Kimwolf's victims, and the boxes it bought were already running malware out of the box. Kimwolf infected devices through residential proxy networks, and several proxy providers also allowed access to devices on the local network.

According to the authors, more secure defaults from manufacturers strengthen protection against both traditional and AI botnets, and regulation helps. Since 29 April 2024, the UK has banned the sale of consumer smart devices that use default passwords, and manufacturers must state the minimum period for which they provide security updates. In the EU, the Cyber Resilience Act (CRA) entered into force on 10 December 2024. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities and severe security incidents affecting their products, and the main obligations apply from 11 December 2027. From then on, manufacturers must state at the time of purchase, to the month and year, how long they will handle the product's vulnerabilities. Devices placed on the market earlier are covered only after a substantial modification.

What should you do now on your company network?

These steps also protect against today's traditional botnets.

1. Take inventory of the devices connected to your network: TV boxes, smart TVs, cameras, video-conferencing units, NAS devices and smart appliances.
2. Put IoT devices on a separate network segment that cannot reach company computers and servers. Hungary's National Cyber Security Institute (NKI) considers a separate VLAN the safest option.
3. Do not connect TV boxes to the company network; Synthient gives organizations the same advice and says an infected box should be wiped completely or destroyed. Check that no device accepts ADB connections without authentication; Kimwolf targeted TCP port 5555, among others.
4. When buying a device, ask how long it will receive security updates, and change the default password when you install it.
5. Watch your network traffic for the signals the authors name: multi-gigabyte downloads to an IoT device, sustained traffic between two devices, scanning and unusual outbound connections.
6. Set spending limits and alerts on API keys, rotate them regularly, and keep them out of source code.
7. If you run an open-weight model on-premise, on your own GPU server, expose the model endpoint only with authentication.
8. Restrict your AI agents' outbound connections to the destinations they need; our article on restricting AI agents describes the steps.