Anthropic's Frontier Red Team published research on self-replicating AI on October 12, arguing that small open-weight models "may be months away" from copying themselves across cheap, poorly secured devices such as Android TV boxes. BleepingComputer's coverage stresses the caveat that matters most: no real-world worm exists, and the tests were simplified. This post covers what was tested and what a developer running agents should check.
TL;DR
| Question | Answer |
|---|---|
| Is this happening now? | No. Anthropic says no model did the full process reliably, and none did it on real IoT hardware end to end |
| Am I affected? | Only if you have devices with unauthenticated ADB, default passwords or open debug services |
| Is there a patch? | No CVE or product bug; this is a capability forecast |
| Does it involve coding agents? | The test harness was built on the open-source Pi coding agent |
| What is the defense? | Network hygiene, segmentation, monitoring for large model downloads |
How the experiment worked
Anthropic splits replication into four stages: finding targets, gaining execution, setting up inference, and propagating from the new host. It largely set aside the exploit stages, citing earlier work showing small models can handle them, and focused on inference setup, the step that is new for malware: working out unfamiliar hardware and getting a model to run on it.
- Setup across hardware. Models were asked to serve Llama3.1-8B on hardware ranging from Jetson Nanos to Mac PCs and RTX 4090s. A 9B-parameter model got inference running on 8 of 9 hardware types. GLM-5.2 was more reliable and faster.
- End to end in an emulated network. An 8-node firewalled network of Android 15 emulators was infected over an unauthenticated ADB port. GLM-5.2 reached all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. Anthropic calls this an upper bound because the cyber step was trivial.
- Memory across attempts. A harness called Memento restarts agents with notes from earlier attempts. Qwen3.5-9B's setup success rose from 45% in the first generation to 61 to 84% in later ones.
- Demo hardware. Gemma4-26B-A4B was split across 15 Android TV boxes costing about $55 each, at roughly 0.3 to 0.4 tokens per second.
Why inference setup is the stage that matters
Finding a target and getting a shell are well-trodden problems for malware, and Anthropic points to earlier benchmarks showing small models can already do much of that work. Setting up inference is different. In Anthropic's words, it requires "a fairly long sequence of hardware and OS-specific decisions around picking a compatible inference stack, finding the right versions of packages, and debugging machine-specific issues." The steps depend on each other, so one early mistake is hard to recover from.
Anthropic also notes that a replicator of this kind would not need root privileges. Inference engines can run entirely in userspace, and many low-security devices can simply be re-infected after a restart. It compares this to crypto miners and botnets such as P2Pinfect and Fritzfrog, which run without privilege escalation but try for it when they can.
The Memento harness and why it helps small models
Anthropic ran its tests inside Memento, a harness it built on top of the open-source Pi coding agent. The design targets a common failure in long runs: an agent fixates on a wrong idea and keeps pursuing it instead of backtracking. The post gives an example of a Qwen agent that spent hours debugging package versions when the real fault was an endpoint incompatible with the grader API.
Memento works in a loop. An agent instance works until a generation timeout, then writes a short note on the strategies it tried, the failures it hit and its performance. A new instance inherits the workspace and the notes. In the serving experiment each model had 1.5 hours per iteration and 6 hours in total, and the prompt carried about 1,000 tokens of hardware specifications and a sample profiler script. Anthropic says the harness is meant to improve long-horizon reliability, not to grant new cyber or inference skills, and that small models should improve as replicators even without it.
How a 26B model fits on 15 cheap TV boxes
Typical off-brand Android TV boxes ship with 1 to 4 GB of RAM. Anthropic's arithmetic assumes 4 GB per box and 4-bit quantization, which allows a 9B model on four or more machines and a 26B model on ten or more. For the demo it split Gemma4-26B-A4B across 15 boxes using pipeline parallelism, so each box holds a small share of the layers. It chose that scheme for fault tolerance, citing the Petals paper: if one node of a tensor-parallel or expert-parallel group fails, the whole group fails, while a pipeline can replace a lost node and recompute its cache.
These devices are bound by memory bandwidth, not compute. Anthropic reports that both prefill and decode speed fall as the context grows, and that models lose much of their competence when the context window is restricted below 32K tokens. That 32K assumption drives the timing estimates below.
The speed estimate, step by step
A 32K-token window in this workload is 12 to 15% generated tokens, with the rest prefill from prompts and tool output. Anthropic puts one full window at 27.3 to 31.8 hours for Gemma4-26B-A4B and 10.9 hours for Qwen3.5-9B. A full setup trajectory needs roughly 2.6 to 4.7 windows, which gives the 71 to 150 hour and 28 to 51 hour figures quoted above.
To size a hypothetical fleet, the researchers use the Kimwolf botnet, which Synthient put at more than 2 million devices, mostly Android TV boxes. If every group of 15 TVs ran one copy of Gemma4-26B-A4B, that would be about 133,000 replicas and about 80,000 tokens per second across the botnet. An H100 serving the same model at high concurrency reaches about 1,950 tokens per second, so the whole swarm equals at most about 40 H100s. Anthropic calls this a tiny amount of compute, and describes the replicators as "slow replicators" that copy over days, comparing them to a slime mold. It labels the figure a rough estimate anchored on one class of hardware and one past botnet.
Floor and ceiling
The post frames the forecast as two lines that have not yet met. A capability floor is what a worm needs to complete replication reliably; in the simplified test, GLM-5.2 sits above it. A size ceiling is what the target devices can hold; Qwen3.5-9B and Gemma4-26B-A4B fit under it for 4 GB TV boxes. For now no model is both small enough and capable enough. Anthropic fits a trend of 13.7 points per year on the Epoch Capabilities Index (R squared of 0.95) across open-weight models of 30B parameters or fewer, and on that line a small model reaches GLM-5.2's level by the end of 2026. It adds that the index is only a proxy for replication ability.
Where the evidence is weaker
Two results cut against the alarming reading. First, a stronger model did not help a weaker one: giving Qwen3.5-9B access to Opus 4.8 as an advisor produced no significant improvement, because small models tend not to know which questions to ask. Anthropic infers that coordination is more likely to come from a large model that directs small subagents. Second, the cyber step was trivial by design, so the 8-node result is an upper bound. The post is also candid that it did not demonstrate a worm on real hardware, and that its defenders-have-time conclusion rests on the measured slowness.
Background: why Android TV boxes and ADB
Anthropic points to Kimwolf as the representative threat. Krebs on Security's January 2026 reporting describes how Synthient saw more than 2 million infected devices, with two-thirds being Android TV boxes that have no security or authentication built in. Researcher Benjamin Brundage found that virtually all the boxes he tested shipped from the factory with Android Debug Bridge (ADB) mode on. In that state a device listens for unauthenticated connections, and Krebs notes that typing adb connect with the device's local IP followed by :5555 can offer administrative access. Kimwolf reached these devices by tunneling through residential proxy networks into the local networks of the proxy endpoints, which sit behind the user's router.
That is the exposure Anthropic's simplified test copied: an open ADB port with no authentication. The point of the comparison is that real IoT security may not be much harder than the trivial step in the experiment. Mirai, the post notes, spread by trying a list of default manufacturer usernames and passwords.
Speed is the limiting factor. Setup took 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. Anthropic argues that gives defenders time. Its trend estimate is that a small model matching GLM-5.2 may exist by the end of 2026, though it calls the metric a rough proxy.
What this means if you run AI coding agents
This is not a vulnerability in your agent, but it raises the value of three habits:
-
Close debug ports. Unauthenticated ADB was the entry point. Check development devices, TV boxes and test phones for exposed ADB (default port 5555) and other debug services.
-
Segment cheap hardware. Put IoT devices and test rigs on a separate network with restricted outbound traffic. Anthropic's suggested signals are large model-weight downloads and unusual device-to-device traffic.
-
Remember who else runs agents. The same harness techniques that make a coding agent good at unfamiliar setups are available to attackers. Anthropic's earlier threat reports, covered in our write-up of the September 2026 report and the GTG-10007 exploit foundry, show agents already used in real intrusions.
-
Check your own network for open ADB. Krebs's description gives a simple test for your own devices only: from a machine on the same network,
adb connect <device-ip>:5555. If the device accepts the connection without any prompt, anyone on that network can reach it the same way. Turn debugging off in the device settings, or keep the device off the network if the vendor gives no way to do so.
Anthropic's blue-team suggestions
Anthropic frames defense as an epidemic problem: push R0, the number of new devices each infected device goes on to infect, below 1 so the replicator dies out. Several points favor defenders. A weight-based replicator leaves a network signature: multi-gigabyte model payloads arriving at new hosts, sustained device-to-device traffic from distributed inference, and extra scanning and outbound connections. The replicator also trades speed against stealth, since faster copying means more traffic. Once found, decoy devices (honeypots) can collect its harness and payload for study.
On remediation, the post cites Mirai: when an ISP used externally obtained infection evidence to quarantine and notify customers, 92% of infections cleared within 14 days, against 74% with no notification. Manufacturers can shrink the target pool too, and Anthropic notes that default IoT passwords are now non-compliant in UK markets. It admits that eliminating a replicator fully would need coordination across every ISP with an infected network.
What developers are saying
The Hacker News thread was mostly skeptical, and a few points are worth recording as reports from the commenters, not as findings.
- User hypfer argued that smart ovens and similar devices do not have the RAM for even a 9B model, and called the extrapolation from GLM-5.2 to future small models speculation. verdverm raised a related question about which IoT devices have about 20 GB of storage plus enough memory. Anthropic's own sizing is the 4 GB TV box with sharded layers, not a single oven.
- flanked-evergl wrote that any device this easy to compromise would be an easier target for ordinary malware, and that compute remains the limit. This matches Anthropic's own framing that the worm would be slow.
- Shamanoid joked about watching AI malware type "curl" one character at a time on a cluster of Raspberry Pis. The point is the one Anthropic makes about 0.3 to 0.4 tokens per second.
- status_quo69 predicted that TVs are an easy target for a patient, self-modifying program, and said they would not be surprised if some already exist. That is the commenter's opinion; Anthropic reports no such worm.
Several other commenters questioned Anthropic's motives for publishing. That is a debate about policy and framing, separate from what the experiments measured.
What Beam can and cannot do here
Beam watches what coding agents run on your own machine. If you use an agent to manage a Raspberry Pi or a lab full of devices, Beam can flag risky commands and credential exposure in those sessions; see Beam on a Raspberry Pi. It does not monitor your network, scan other devices for open ADB, or detect a replicating model on an IoT box. Its checks are heuristic and its deny works through Claude Code and Codex hooks, not a network firewall. Related supply-chain risk is covered in npm worms targeting AI tooling, and the monitor-versus-block trade-off explains what hook-based enforcement does and does not cover.
Frequently asked questions
Is there a self-replicating AI worm in the wild?
No. Anthropic says no model completed the full process reliably and no fully autonomous worm was shown on real IoT hardware.
What did Anthropic actually demonstrate?
A 9B-parameter model got inference running on 8 of 9 hardware types, and GLM-5.2 spread across an emulated 8-node Android network in 4 of 5 trials, then 7 of 8 in the fifth.
Why does this matter to people running coding agents?
The harness was built on an open-source coding agent, and the skill involved, setting up unfamiliar software, is what makes coding agents useful. The exposure is ordinary: open debug ports and default passwords.
How fast could it spread?
Slowly. Inference setup took 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B on tested hardware, with a doubling time of days.
What should I check?
Make sure no device exposes ADB or other debug services without authentication, change default passwords, and segment IoT devices with restricted outbound traffic.
Related reading
Details reflect Anthropic's October 12, 2026 research post and press coverage as of October 13, 2026. Check Anthropic's post for updates.