Summary: Anthropic’s Frontier Red Team published research on October 12 showing that, in a simulated network of Android devices, the open-weight model GLM-5.2 could complete an end-to-end self-propagation flow, reaching all 8 test nodes in 4 of 5 trials. The Register pushed back on the deliberately permissive lab setup. Both sides agree the real entry point is unsecured cheap IoT hardware — and that’s where you can act today.
What the experiment actually showed
The question behind the research: can an AI copy itself across devices without a data center? First, the team proved cheap hardware can even run models — they distributed the Gemma4-26B-A4B model across 15 white-label Android TV boxes at roughly $55 each, running at 0.39 tokens per second. Slow, but it worked. A separate test found that a 9B model could set up its own inference environment on 8 of 9 hardware types.
The core test ran on a firewall-isolated network of 8 nodes running Android 15 emulators in Google Cloud. Only GLM-5.2 finished the full propagation chain — and even then, it operated the deployment of a Llama3.1-8B inference service, with the test harness launching the next agent. So this is not an 8B model replicating on its own. Models under 30B parameters handled many individual steps but failed when stringing them together.
The timeline claim, and its own caveats
Anthropic extrapolated from Epoch’s general capability index: small-model ECI has been rising about 13.7 points per year, which would hit this experiment’s capability level by end of year. The researchers themselves flagged that ECI is only a proxy for replication ability.
They also disclosed the bigger caveat: the test devices’ ADB ports had no authentication. Anthropic framed the results as an upper bound on real-world success rates — though they note past IoT botnets spread just by trying vendor default passwords. I covered the lab-condition debate in more detail earlier in When a Cheap TV Box Can Host a Model.
Why skeptics aren’t wrong, but the devices still are
The Register’s Brandon Vigliarolo made two fair points. The nodes were purpose-built and deliberately left open to attack, and the conclusion depends on assuming GLM-5.2-level capability can fit into a small model like Llama3.1-8B. He also compared speeds: Mirai doubled roughly every hour in 2016, while Anthropic estimates an AI worm would take days per copy — a 9B model needs 1–2 days per replication — and multi-gigabyte model files would be conspicuous on ISP traffic monitors.
But here’s the uncomfortable overlap: Synthient research, reported by The Hacker News in January, found the Kimwolf botnet had infected over 2 million Android devices, including smart TVs and set-top boxes. At least 67% of them had ADB enabled without authentication — the exact same entry point Anthropic left open on purpose. Those devices were already being monetized for residential proxy bandwidth, DDoS-for-hire, and credential stuffing. The AI worm scenario doesn’t need to arrive for this infrastructure to be a problem.
Anthropic also sized the ceiling: even a Kimwolf-scale network of 2 million devices would max out at inference capacity comparable to roughly 40 H100 GPUs. Cheap botnets are a persistence problem, not a compute goldmine.
The defense worth doing regardless
Anthropic borrowed an epidemiology frame: drive R₀ — new infections per infected device — below 1. The tactics are unglamorous. Block or restrict devices with unauthenticated ADB, as The Hacker News recommended in January. In the Mirai era, a 2019 study found a Dutch ISP cleared 92% of infections within 14 days by isolating and notifying users; unnotified users reached only 74%. Default passwords on IoT devices are already non-compliant for the UK market.
If you ship Android-based hardware or manage a fleet of cheap devices, the practical step is an audit of debug ports and factory credentials this sprint — the same hygiene that makes an AI worm harder also shrinks the botnet surface that exists today. Anthropic’s year-end timeline remains unproven; the ADB cleanup doesn’t need to wait for it.