Anthropic Research Warns of Emerging Risks From Self-Replicating AI Worms

Artificial intelligence models may soon become capable of spreading across internet-connected devices without continuous human direction, according to new research from Anthropic that raises questions about how cybersecurity defenses could respond to increasingly autonomous software.

In a study researchers William Zhou and Daniel Freeman examined whether relatively small AI models could establish themselves on unfamiliar hardware and reproduce across connected systems. Their findings suggest that some of the technical barriers to self-replicating AI are becoming easier to overcome.

The research does not establish that a fully autonomous AI worm is already circulating on the internet. Instead, it identifies capabilities that could eventually allow malicious software to adapt to different devices, operate without centralized computing infrastructure and potentially become more difficult to eliminate.

The implications extend beyond AI developers. Businesses increasingly rely on connected cameras, communications equipment, smart appliances and other networked devices, creating a broad range of systems that could become targets if autonomous replication capabilities improve.

One of the study's most striking demonstrations involved hardware normally associated with home entertainment rather than advanced computing.

Anthropic's researchers connected 15 inexpensive Android TV boxes, costing approximately $55 each, and used them collectively to run Gemma4-26B-A4B, an AI model with 26 billion total parameters. The distributed system processed approximately 0.39 tokens per second, showing that relatively modest devices could collectively support a substantial AI model.

The experiment illustrates a potential shift in how malicious AI systems might operate. Instead of depending entirely on powerful data center processors, a future replicating model could distribute its computing workload across numerous compromised devices.

Such an arrangement would introduce a different challenge for defenders. Removing access to a single server might not eliminate software operating across a dispersed network, although the relatively slow processing speeds observed in the experiment would constrain its activity.

The researchers also examined whether smaller models could configure AI inference software on unfamiliar hardware. In their evaluations, a nine-billion-parameter model successfully established inference on eight of nine tested hardware types.

The researchers conducted a separate series of experiments to investigate whether AI models could complete the steps associated with autonomous replication.

Using an isolated Google Cloud environment containing eight Android-emulated nodes, the team tested models on their ability to identify additional systems, transfer the necessary software and establish AI inference on new machines.

Among the open-weight models evaluated, GLM-5.2 was the only one to reliably complete the full experimental replication sequence. It reached all eight nodes in four of five trials and seven nodes in the remaining trial.

However, the test deliberately simplified a major obstacle: gaining unauthorized access to another device. The experimental systems exposed an Android debugging interface without authentication, allowing the researchers to concentrate on replication and software deployment rather than realistic exploitation.

Another limitation concerned the model's computing requirements. GLM-5.2 performed the replication tasks while operating on separate infrastructure, rather than independently running on the small devices it reached.

The results therefore show that certain AI systems can coordinate replication under controlled conditions. They do not prove that today's smaller models can independently compromise and reproduce across ordinary consumer networks.

Traditional computer worms generally depend on predefined instructions or known vulnerabilities to spread between systems. A sufficiently capable AI-based worm could potentially make decisions about unfamiliar hardware and adjust its behavior when an initial approach fails.

Anthropic investigated this possibility by allowing successive AI agent instances to inherit notes about previous attempts. In one evaluation involving Qwen3.5-9B, successful inference setup increased from 45% in the first generation to between 61% and 84% in later generations.

The result suggests that passing information between successive instances can improve performance on a technical task. It does not establish that malicious software would learn or spread at the same rate outside the laboratory.

The broader concern is that an adaptive program might eventually require less advance knowledge of the systems it encounters. That could complicate defenses built around identifying known malware behavior or particular device vulnerabilities.

There are also practical constraints. Small models running on inexpensive hardware process information slowly, and transferring AI model files between devices can generate substantial network traffic.

According to Anthropic's estimates, certain replication tasks on the tested low-cost hardware could take more than a day. Such delays would make the hypothetical systems considerably slower than many conventional worms, even if they proved capable of operating with greater independence.

The research has implications for organizations managing large numbers of internet-connected devices, particularly where equipment receives limited security updates or operates with weak default configurations.

A future AI-driven botnet could potentially use compromised hardware for both computing and further propagation. This would expand the importance of device inventories, access controls and network monitoring beyond conventional computers and servers.

Anthropic identified several possible defensive advantages. Large model transfers and sustained communication between devices could create detectable network anomalies, while coordinated action by internet service providers could help isolate infected systems.

The researchers also pointed to stronger device security requirements as a way to reduce the number of accessible targets. Measures such as eliminating insecure default passwords would help address vulnerabilities exploited by conventional malware as well as potential AI-based threats.