AI Worms Could Hijack Millions of Cheap IoT Devices Without a Data Center, Anthropic Warns

Anthropic researchers have demonstrated that small AI models running on $55 Android TV boxes can replicate across networks of unmanaged IoT devices — no cloud infrastructure required — raising urgent alarms for security leaders worldwide.

For years, cybersecurity professionals operated under a reassuring assumption: any AI system dangerous enough to self-replicate would need serious computational muscle. Think data centers, GPU racks, and cloud accounts — environments where detection tools are mature and someone is actively watching. New research published October 12th by Anthropic's Frontier Red Team shatters that assumption entirely.

Researchers William Zhou and Daniel Freeman have shown that small AI models are potentially months away from autonomously copying themselves across cheap, poorly-defended IoT devices — off-brand Android TV boxes, smart ovens, security cameras, and video-conferencing units. A replicator like that would have no central server to unplug and no obvious place to look. Understanding the broader risks and challenges artificial intelligence poses to business has never been more urgent than it is today.

---

The $55 TV Box Experiment That Changed the Conversation

The headline demonstration is almost disarmingly simple. Anthropic purchased 15 off-brand Android TV boxes at roughly $55 apiece, each equipped with 4GB of RAM. Researchers networked them together and ran Google's Gemma4-26B-A4B model distributed across all 15 devices — each box holding a slice of the model's layers. The system ran at 0.39 tokens per second. Slow, but functional.

The more significant finding concerned adaptability. Traditional malware only runs on systems its authors specifically built it for. Anthropic tested whether open-weight models could independently configure an inference server — the software that runs an AI model — on hardware they had never encountered before. Alibaba's Qwen3.5-9B, a 9-billion-parameter model, successfully got inference running on eight of nine hardware types tested, ranging from Nvidia Jetson Nanos to Mac PCs.

Anthropic breaks an AI worm into four stages:

1. Find a target
2. Gain execution
3. Stand up inference
4. Repeat from the new host

To test the full cycle, researchers built a firewalled cloud network of eight nodes running emulated Android, with an unauthenticated Android Debug Bridge (ADB) port serving as the entry point. Only one model tested — Zhipu AI's GLM-5.2 — completed full end-to-end replication, reaching all eight nodes in four of five trials and seven of eight nodes in the fifth trial. Every other model failed reliably.

Important caveats apply. The models were instructed to replicate; they were not choosing to. The exploit step was deliberately simplified, making the result an upper bound on capability. GLM-5.2 itself ran on a separate server because the emulated devices were too small to host it.

The 2026 Timeline and What It Means

That last constraint is precisely where the timeline comes from. Plotting small open-weight models against the Epoch Capabilities Index, Anthropic identified a gain of approximately 13.7 points per year — enough to put a small model at GLM-5.2's capability level by the end of 2026. The researchers acknowledge this index is only a proxy and the date a rough estimate.

The window to act is measured in months, not years. Security teams that treat this as a future problem risk being caught unprepared when capability thresholds are crossed.

---

A Digital Slime Mold That Learns From Failure

This is not a fast-burning threat in the traditional sense. On the TV-box hardware, a full inference setup would take Qwen3.5-9B roughly 28 to 51 hours and Gemma4 approximately 71 to 150 hours to complete. Anthropic estimates that a botnet the size of Kimwolf — which infected more than 2 million devices, predominantly Android TV boxes — would translate to at most around 40 Nvidia H100s worth of inference capacity.

Researchers describe the result as a "digital slime mold" that multiplies over days rather than minutes. What distinguishes it from conventional botnets is its capacity to adapt. When each Qwen3.5-9B instance passed notes on failed strategies to the next generation, setup success rates climbed from 45% to between 61% and 84% in later generations. The worm becomes better at navigating your specific environment the longer it survives there.

To understand why this marks a significant departure from conventional threats, it helps to review the different types of malware and how adaptive AI-driven variants compare to their static predecessors.

Industry Voices on What This Changes

John Gallagher, Vice President at Viakoo, placed the research in historical context spanning from Mirai in 2016 to Kimwolf today. "Traditional botnets are static scripts," he said. "Anthropic's experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails."

Gallagher called out the broader implication plainly: "This destroys the myth that cybercriminals need to harness powerful or IT-based compute capabilities. Anthropic proved that 15 cheap TV boxes without proper cyber hygiene networked together can execute distributed inference."

Collin Hogue-Spears, Senior Director of Solution Management at Black Duck, argued that persistence rather than raw power represents the true risk. "The risk is persistence, not horsepower," he said. "On Anthropic's numbers, an AI worm on cheap hardware doubles in days. A device that restarts clean stays exposed until someone closes the port the worm came through."

Ram Varadarajan, CEO at Acalvio, emphasized that model-level safeguards alone will prove insufficient. "Because open-weight models can be stripped of refusals or chosen without them, safety can't live only in the weights or the serving layer," he said. "Cyber defenders need controls in the environment the AI model operates in."

The Epidemiological Framework Defenders Should Adopt

Anthropic frames defense in epidemiological terms: push R₀ — the number of new devices each infected one goes on to infect — below 1, and the replicator dies out rather than becoming endemic. Historical precedent offers further reason for measured optimism. During the Mirai cleanup, an ISP that quarantined and notified infected customers cleared 92% of infections within 14 days, compared with 74% without notification.

The faster a worm spreads, the louder it becomes. A weight-based replicator is noisy — Anthropic notes it would leave clear network signatures: multi-gigabyte model payloads landing on newly infected devices and sustained device-to-device traffic between machines that ordinarily never communicate. This is a meaningful detection advantage, provided someone is watching for it.

---

What Security Leaders Must Do Now

The uncomfortable reality is that the attack surface Anthropic describes is the one most organizations manage least: the conference room display, the lobby kiosk, the branch-office camera — devices that cannot run an endpoint agent and are rarely inventoried with any rigor.

The encouraging reality is that defenders are not without options. The intersection of AI and cybersecurity is generating new detection capabilities and monitoring frameworks that can be applied to exactly this class of threat.

Immediate Steps for Security Teams

Security leaders can act immediately on several fronts:

• Inventory unmanaged Android-based devices — displays, TV boxes, kiosks, and video-conferencing units represent the logical starting point; if you cannot see them, you cannot defend them
• Disable exposed debugging services — any debugging service answering over the network, particularly ADB on TCP port 5555, should be disabled outside maintenance windows
• Enforce network segmentation — allowlists and traffic monitoring for gigabyte-scale transfers to agentless devices will catch what code-level detection misses
• Establish firmware governance — devices running outdated firmware or vendor-abandoned software should be flagged for replacement or isolation, not left running indefinitely
• Define incident response procedures for IoT — most IR playbooks are built around endpoint and cloud; expanding them to cover unmanaged devices before an incident occurs is a meaningful risk reduction

Measuring Your Exposure Before the Threat Matures

Organizations that invest in passive network visibility now will be best positioned when model capabilities close the remaining gap. Agentless network monitoring tools can baseline normal device behavior — traffic volume, communication patterns, connection frequency — and flag deviations consistent with replication activity without requiring software to be installed on the devices themselves.

The NIST National Vulnerability Database remains a practical resource for tracking disclosed vulnerabilities in IoT firmware and associated software components, enabling security teams to prioritize patching where it remains possible.

Anthropic's researchers describe what they are observing as early signs of life — comparable to where coding agents stood in 2024. The AI worm they describe is slow, constrained, and not yet real. But it doesn't need a data center. It only needs the devices nobody is watching.