Worms That Carry Their Own Brain: Why Anthropic Thinks AI Malware Is Only Months Away
A worm that carries its own brain
In security parlance, a worm is code that copies itself from one machine to the next without tricking a human into clicking anything. Anthropic's Frontier Red Team argues that AI models are turning into a new species of that old threat. An "AI worm," as the company describes it, would carry its model weights — the model itself — as part of the malware payload, then run inference directly on the hardware it has just compromised. Anthropic calls the result a small weight-based replicator.
Anthropic's warning: months, not years
The report, published on a Monday by Frontier Red Team researchers William Zhou and Daniel Freeman, concludes that small AI models "may be months away from being capable enough" to copy themselves across commercial internet-of-things devices. Anthropic is careful to say it has not seen a working rogue replicator, describing the evidence instead as "signs of life." The warning was picked up by Al Jazeera, the Guardian, CBS News, Ars Technica and others.
Four steps to self-replication
Twenty-six billion parameters on fifteen TV boxes
The replicators that take notes
No off switch
The company's central worry is stated plainly: "A replicator like this would be challenging to shut down, since there's no centralized point to shut off." The projected doubling time is measured in days — slower than the worms of the Slammer era, closer to what the researchers call a distributed "digital slime mold." Smart-home devices are patched far less often than phones or laptops, and an AI worm could look up newly disclosed vulnerabilities and adapt to hardware it has never encountered. In a worst case, Anthropic imagines swarms of AI worms attacking computing hardware together.
Doing the math on a two-million-device botnet
Experts split on how loud the alarm should be
Nicolas Papernot of the University of Toronto, who built a prototype AI worm with freely available models in June, calls the threat concrete and deserving immediate action, with hospitals and power grids the priority. Jeffrey Ladish of Palisade Research expects the first AI worms in the wild within 12 months. Joshua Saxe, formerly of Meta's AI security effort, worries the security community is not taking it seriously enough. Others push back: Georgia Tech's Michael Bailey warns against fearmongering, noting that self-replicating malware already exists, and researcher Xiaohan Fu argues the experiments demonstrate capability, not that small models would choose to replicate.
Who actually gets hit
Anthropic expects homes and small businesses to be first in line: smart ovens, TVs, robot vacuums and similar gadgets that ship with minimal security. A reminder of what unpatched connected hardware can already do arrived in mid-October, when attackers took over refrigeration controllers in hundreds of supermarkets and forced freezers into defrost mode, pushing temperatures to 50C for six hours and causing losses estimated in the millions of dollars.
What defenders can do now
Anthropic frames defense as epidemic control: push each infection's reproduction number below one. Multi-gigabyte model transfers and sustained device-to-device traffic should stand out in ISP flow monitoring, honeypots can capture a replicator's code, and quarantine can work — during the Mirai outbreak, one provider that quarantined and notified infected customers cleared 92% of infections within 14 days, against 74% without notification. Britain has already banned default passwords by law. Anthropic's own conclusion: harden systems so replicators struggle to spread, but prepare for a world in which they are here to stay.
