Worms That Carry Their Own Brain: Why Anthropic Thinks AI Malware Is Only Months Away

Worms That Carry Their Own Brain: Why Anthropic Thinks AI Malware Is Only Months Away

A worm that carries its own brain

In security parlance, a worm is code that copies itself from one machine to the next without tricking a human into clicking anything. Anthropic's Frontier Red Team argues that AI models are turning into a new species of that old threat. An "AI worm," as the company describes it, would carry its model weights — the model itself — as part of the malware payload, then run inference directly on the hardware it has just compromised. Anthropic calls the result a small weight-based replicator.

Anthropic's warning: months, not years

The report, published on a Monday by Frontier Red Team researchers William Zhou and Daniel Freeman, concludes that small AI models "may be months away from being capable enough" to copy themselves across commercial internet-of-things devices. Anthropic is careful to say it has not seen a working rogue replicator, describing the evidence instead as "signs of life." The warning was picked up by Al Jazeera, the Guardian, CBS News, Ars Technica and others.

Four steps to self-replication

Anthropic breaks autonomous replication into four stages: finding targets, gaining code execution, establishing an inference server on the compromised machine, and propagating onward from there. In the lab, researchers built a firewalled network of eight nodes emulating Android 15 devices, one of them exposing an unauthenticated port. Among the open-weight models tested, only GLM-5.2 completed the chain reliably, reaching all eight nodes in four of five trials and seven of eight in the fifth; the rest never spread past the starting device.

Twenty-six billion parameters on fifteen TV boxes

In a parallel experiment, Anthropic wired together 15 cheap Android TV boxes bought for about $55 each and used them to serve a 26-billion-parameter model, crawling at roughly 0.39 tokens per second. The 9B Qwen3.5-9B showed a talent for unfamiliar hardware, getting inference running on 8 of the 9 device types tested. Speed is the catch: serving a model took 29 to 51 hours with Qwen3.5-9B, and 71 to 150 hours with Gemma4-26B-A4B.

The replicators that take notes

Anthropic also tested whether replicators improve as they spread. Successive generations of Qwen3.5-9B left short notes for their successors about which strategies worked and which failed, and the success rate for setting up inference climbed from 45% in the first generation to between 61% and 84% later on. That, the researchers suggest, is why a replicator could handle device models nobody has ever seen.

No off switch

The company's central worry is stated plainly: "A replicator like this would be challenging to shut down, since there's no centralized point to shut off." The projected doubling time is measured in days — slower than the worms of the Slammer era, closer to what the researchers call a distributed "digital slime mold." Smart-home devices are patched far less often than phones or laptops, and an AI worm could look up newly disclosed vulnerabilities and adapt to hardware it has never encountered. In a worst case, Anthropic imagines swarms of AI worms attacking computing hardware together.

Doing the math on a two-million-device botnet

For scale, the report points to Kimwolf, an Android botnet that has infected more than two million devices; roughly 67% of devices in proxy pools had unauthenticated debug ports, and the botnet fired about 1.7 billion DDoS commands in three days. If one copy of a 26-billion-parameter model ran on every 15 boxes, a botnet that size could host around 133,000 replicas — at most about 40 Nvidia H100 GPUs of combined compute, with each replication taking more than a day.

Experts split on how loud the alarm should be

Nicolas Papernot of the University of Toronto, who built a prototype AI worm with freely available models in June, calls the threat concrete and deserving immediate action, with hospitals and power grids the priority. Jeffrey Ladish of Palisade Research expects the first AI worms in the wild within 12 months. Joshua Saxe, formerly of Meta's AI security effort, worries the security community is not taking it seriously enough. Others push back: Georgia Tech's Michael Bailey warns against fearmongering, noting that self-replicating malware already exists, and researcher Xiaohan Fu argues the experiments demonstrate capability, not that small models would choose to replicate.

Who actually gets hit

Anthropic expects homes and small businesses to be first in line: smart ovens, TVs, robot vacuums and similar gadgets that ship with minimal security. A reminder of what unpatched connected hardware can already do arrived in mid-October, when attackers took over refrigeration controllers in hundreds of supermarkets and forced freezers into defrost mode, pushing temperatures to 50C for six hours and causing losses estimated in the millions of dollars.

What defenders can do now

Anthropic frames defense as epidemic control: push each infection's reproduction number below one. Multi-gigabyte model transfers and sustained device-to-device traffic should stand out in ISP flow monitoring, honeypots can capture a replicator's code, and quarantine can work — during the Mirai outbreak, one provider that quarantined and notified infected customers cleared 92% of infections within 14 days, against 74% without notification. Britain has already banned default passwords by law. Anthropic's own conclusion: harden systems so replicators struggle to spread, but prepare for a world in which they are here to stay.