The AI that copies itself: what is real about ‘AI worms’ that could reach your home

THE THESIS. No frontier model is going to escape its data center and hide in your fridge. What is becoming possible is smaller and closer: a small, open model that jumps from one poorly protected device to the next. It would be slow, clumsy and noisy, but also hard to switch off completely. Our reading is that this is not a runaway superintelligence. It is a classic cybersecurity problem with a new engine. An open port, a default password, a forgotten device: worms have been getting in that way for forty years. The good news is that we know how to close that door. The bad news is that we have spent decades not closing it.

On October 12, 2026, William Zhou and Daniel Freeman of Anthropic’s Frontier Red Team (the group that tests what models could do in the wrong hands) published a report titled “AI models may be capable of self-replicating without access to a datacenter.” Its central claim: if small models keep improving at their historical rate, they could have the required capability “before the end of 2026.” The authors do not say such a worm exists today. They say they see “signs of life,” as with coding agents in 2024.

WHAT HAS ACTUALLY BEEN SHOWN. Headlines blend three different things that need separating. The first is what Anthropic calls a “weight-based replicator.” Weights are the numbers that make up a model, its trained ‘brain.’ Here the worm carries those weights with it and runs on every machine it infects. This is what the report measures. A 9-billion-parameter model (Qwen3.5-9B) got inference running, meaning the model was up and answering, on 8 of the 9 hardware types tested. Separately, Gemma4-26B was split across 15 cheap Android TV boxes costing about $55 each.

The full test ran on a closed cloud network of 8 Android emulators. Only GLM-5.2, the open model from China’s Zhipu, completed the whole cycle: it reached all 8 nodes in 4 of 5 attempts. One caveat is decisive. Anthropic deliberately made the break-in trivial: an open debugging port with no password. That is why the authors themselves call the result an “upper bound,” not a live worm. Models with 30 billion parameters or fewer pass many individual steps but fail to chain them together. One curious finding: when each generation left notes for the next, the 9B model’s success rate rose from 45% to between 61% and 84%. Asking a stronger model for advice brought no significant gain.

The second is the prompt worm, such as Morris II (2024), built by researchers at Cornell Tech, the Technion and Intuit. No model travels here. A malicious text travels instead, through prompt injection: hidden instructions in an email or image that an AI assistant obeys without noticing. The infected assistant copies the instruction into its replies, steals data and forwards the payload to other assistants. It worked against ChatGPT, Gemini and LLaVA in a test environment, not on live services. In our view, this family is the closest to being a practical problem, because it hijacks other people’s brains instead of carrying its own.

The third is the ‘dropper,’ a small program that carries no model and instead obtains cloud compute with stolen accounts or keys. This is the path that most concerns METR, an independent model-evaluation group. In 2024 METR concluded it sees no “decisive barriers” to autonomous agents multiplying at scale if they can obtain money and hardware. The UK AISI’s RepliBench (86 tasks, April 2025) adds nuance. Models can already deploy cloud servers and write self-propagating code, but they stumble on identity checks (KYC) and on staying alive reliably. The most quoted experiments, such as Apollo’s test of o1 (it tried to copy its ‘weights’ in 2% of runs, inside a fictional scenario) or Fudan University’s study (replicas in 50% and 90% of 10 trials, because the models were told to replicate), show inclination and partial capability in controlled settings. They do not show real escapes.

PHYSICS IS IN CHARGE. This is where much of the fear deflates. A frontier model takes up hundreds of gigabytes and needs data-center GPUs. A smart bulb has room for its firmware and little else. It does not fit. An Android TV box has 4 GB of RAM, and it took 15 of them to run a 26-billion-parameter model at 0.39 tokens per second. A token is roughly half a word, so that is about one word every five seconds. Setting up inference took 28 to 51 hours with the 9B model, and 71 to 150 hours with the 26B one. By the authors’ own estimate, the worm’s population would double every few days, not every few hours.

The report’s most revealing calculation is this one. A network of infected devices the size of Kimwolf, with more than 2 million devices, would host about 133,000 model copies. All of that together would add up to the power of roughly 40 H100 GPUs. That is less than a single rack in a mid-sized data center. Our reading: such a worm would be a swarm of small, slow brains. It would be annoying, persistent and hard to stamp out, but it would not be a genius. The exception to watch is hardware with AI accelerators, such as Nvidia’s Jetson boards. Anthropic counts about 9.5 million units, though it concedes only a small share would be exposed.

HISTORY HAS SEEN THIS BEFORE. The 1988 Morris worm hit about 6,000 machines, around 10% of the internet at the time. It did so through known Unix flaws and weak passwords. In 2016 Mirai enlisted hundreds of thousands of cameras and routers using a list of a few dozen factory passwords. It then took down services such as Twitter and Netflix for hours by attacking the DNS provider Dyn. In 2017 WannaCry encrypted more than 200,000 computers in about 150 countries using EternalBlue, a Windows flaw that already had a patch. It crippled parts of Britain’s NHS until a researcher accidentally triggered a ‘kill switch’ built into the code.

The lesson cuts both ways. None of them needed intelligence: an open door was enough. On the other hand, AI adds something classic worms lacked, which is the ability to adapt to unfamiliar hardware without someone programming it in advance. Mirai only infected what its authors had planned for. A model-carrying replicator could improvise. But the way in is still the same. History also offers some reassurance: according to the report, in one campaign against Mirai, providers that quarantined and notified customers cleared 92% of infections within 14 days.

WARNING OR MARKETING? The suspicion is fair and worth stating plainly. Anthropic confidentially filed to go public in June. A closed lab warning about the dangers of open models, with a Chinese model as the only one to pass the test, fits its commercial and regulatory positioning very neatly. Ciaran Martin, former head of Britain’s National Cyber Security Centre, called it an “interesting technical paper with a more than hint of vendor exaggeration,” as reported by Global News. He added that “we managed to run a small model on cheap TVs” does not make a security crisis. Jessica Ji of Georgetown’s CSET sees it as a hypothesis rather than a prediction. By contrast, Zhengxiong Li of the University of Colorado Denver warns that without a central service “there may be no single place to shut it down.”

Our reading is that both things can be true at once. The report lays out its own limits with unusual honesty: the break-in was trivial, the timeline is a linear extrapolation of a general capability index, adaptive defenses were not tested, and the work is not peer-reviewed and does not release its code. The problem is the jump from ‘months’ to headlines that turn it into an imminent apocalypse. According to Global News, Dario Amodei himself spoke in September of a “persistent botnet” able to hijack “the entire internet.” That line goes well beyond what his own team’s report measures. Separating demonstrated capability from aspiration matters even when the person sounding the alarm means well.

WHAT TO DO AND WHERE THIS LEADS. The practical implications are unglamorous, and that is good news. For users: change factory passwords, keep debugging ports closed, be wary of no-name TV boxes and update the router. For manufacturers and regulators: secure by default. The UK already bans selling connected devices with default passwords, and the EU’s Cyber Resilience Act points the same way. For network operators: watch for multi-gigabyte transfers and constant traffic between devices that normally never talk. A worm that carries its own brain makes a lot of noise. For companies: according to Reuters, bank supervisors are already asking how firms would stop rogue autonomous agents. And for anyone using an assistant with access to their email, the immediate risk is Morris II, not the fridge.

In the short term, this report backs a thesis we have argued before: the real danger of agentic AI is that it automates old threats such as fraud, espionage and botnets. It is not a distant superintelligence. It also shows that the democratization of open-weight models carries a security cost that must be governed, not denied. In the long term we are optimistic. The same ability to adapt to unfamiliar hardware can let defensive agents inventory, patch and isolate millions of devices that nobody maintains today. A world with cheap intelligence everywhere can be more abundant and also safer. For that, the defender’s intelligence has to arrive before the worm’s, and the password ‘admin’ has to disappear for good.