Summary: On October 12, Anthropic’s Frontier Red Team published research showing an open-weight model completing an end-to-end self-replication flow across a simulated network of Android nodes, and estimated that small models could reach that capability level by the end of this year. TechOrange covered the findings on October 14, along with pushback from The Register over the experiment’s deliberately permissive conditions. For anyone shipping AI on edge or IoT-adjacent hardware, the immediate takeaway is less about a worm arriving tomorrow and more about unsecured ADB ports and default passwords that already exist at scale.
What the red team actually demonstrated
The question Anthropic set out to answer: can an AI copy itself across cheap devices without a data center? Three findings from the TechOrange report:
- A Gemma4-26B-A4B model was sharded across 15 generic Android TV boxes costing about $55 each, running at 0.39 tokens per second — slow, but proof the hardware works.
- A 9B model managed to set up its own inference environment on 8 of 9 test hardware types.
- In the core experiment, an 8-node simulated Android 15 network on Google Cloud, only GLM-5.2 completed the full propagation flow, spreading to all 8 nodes in 4 of 5 trials.
That last result comes with a caveat Anthropic itself disclosed: GLM-5.2 operated the flow, but it deployed a Llama3.1-8B inference service on targets, and the test system launched the next agent. An 8B model has not independently self-replicated. Models under 30B could complete many individual steps but still failed when chaining them.
The timeline claim, and the conditions behind it
Anthropic extrapolated from Epoch’s General Capability Index: small-model ECI rises about 13.7 per year, which would put replication-level capability within reach by year’s end. The researchers noted themselves that ECI is only a proxy, not a direct measure.
They also flagged the bigger limitation: the test nodes had ADB ports left open with no authentication, so the results represent an upper bound on real-world success. Their counterargument is that this simplification mirrors reality — past IoT botnets spread largely by trying factory default credentials.
The Register’s Brandon Vigliarolo pushed back on exactly this. He pointed out the nodes were purpose-built and deliberately left open to attack, and that the year-end conclusion depends on assuming GLM-5.2’s capability can be compressed into something like Llama3.1-8B. He also compared speeds: Mirai doubled roughly hourly in 2016; Anthropic estimates an AI worm would take days per replication, and multi-gigabyte model files would burn bandwidth in ways that expose the source.
Why the botnet baseline already matters
The weakness being tested is not hypothetical. Per The Hacker News’s January report citing Synthient research, the Kimwolf botnet — first disclosed by QiAnXin XLab in December 2025 — has infected over 2 million Android devices, including smart TVs and set-top boxes. At least 67% of them had unauthenticated ADB open by default: the same entry point Anthropic simulated. Those devices were used for residential proxy bandwidth, DDoS-for-hire, and credential stuffing against mail and popular sites.
Anthropic’s own sizing puts a damper on the scary version, though. Even a Kimwolf-scale network of 2 million devices would top out at inference capacity roughly equal to about 40 H100 GPUs, and replication takes a day or more per hop — the researchers likened it to slime mold breeding on a timescale of days.
What to do before any worm shows up
Anthropic borrowed an epidemiology frame: drive R₀ below 1. Two defenses stand out because they are boring and already available. Unusually large inbound transfers (several GB of model weights) leave signatures ISPs can catch — a 2019 study cited in the report found one Dutch ISP cleared 92% of Mirai infections within 14 days of isolating and notifying users, versus 74% for those not notified. And in the UK, default passwords on IoT devices are already non-compliant with regulations.
I’ve written before about giving internal AI tools clear ownership and governance; this is the same instinct applied to hardware. The Register’s closing point and The Hacker News’s January recommendation land in the same place: block or restrict devices running unauthenticated ADB, kill default passwords, and a future AI botnet gets much harder to pull off. Anthropic’s year-end estimate may or may not hold — but the port scan on your own network is free, and it tells you something real today.