Anthropic says AI worms could soon spread through cheap smart TV boxes

A computer worm is a program that copies itself from one machine to the next with no human help. Worms have been around for decades.

An AI worm adds a twist. It would carry an AI model as part of its luggage, or download it again from a public site, and then run that model on every device it takes over. Anthropic calls this a weight-based replicator. The "weights" are the numbers that make up a trained model.

That matters because a regular worm only follows its script. Anthropic says an AI worm could figure out unfamiliar devices on its own, the way a person would read a manual and try things until something works.

In real life Picture a no-name streaming box you bought online for about $55. It sits on the shelf, connected to Wi-Fi all day, and probably never gets a security update. That is exactly the kind of device the researchers had in mind.

Big AI models need big data centers. Small ones don't. The team bought 15 off-brand Android TV boxes, about $55 each, and wired them together.

None of them could run a capable model alone. Together, they could. The researchers split Google's Gemma4-26B-A4B, a 26-billion-parameter open model, across all 15 boxes.

• Memory per box: 4GB
• Model share per box: 2 of the model's layers
• Speed: 0.39 tokens per second, roughly a word every few seconds

Think of it like a bucket brigade. Each box does a small part of the work and passes it down the line. Slow, but it gets there.

They also tested whether small models can set up AI software on hardware they have never seen. A 9-billion-parameter model managed it on 8 of the 9 hardware types tested, from tiny Jetson Nano boards to Macs and gaming graphics cards.

To find out, Anthropic built a closed test network of 8 cloud machines pretending to be Android devices. It planted a worm on one of them and watched.

The worm had to scan the network, connect to a new machine, copy over its files and get an AI model running there. Then the new copy had to do it again.

By the numbers:

• Models tested: several open-weight models of different sizes
• Full success: only Z.ai's GLM-5.2
• GLM-5.2 result: spread to 8 of 8 machines in 4 of 5 trials, and 7 of 8 in the fifth
• Everyone else: failed reliably on the full chain, though smaller models handled many single steps

There's an important catch. The test kept the hacking part trivial. The machines had an open debug port with no password, so Anthropic calls the results an upper bound on real-world success.

But it also points out that the old Mirai botnet spread by simply trying lists of factory default passwords. Real home devices may not be much harder to break into than the test setup.

Anthropic tracked how fast small open models, 30 billion parameters or fewer, are getting smarter. It used a score called the Epoch Capabilities Index. The best small models have gained about 13.7 points a year.

GLM-5.2 is too large for a TV box today. But if small models keep improving at their usual pace, Anthropic says, a small model will match GLM-5.2's ability to spread by the end of 2026.

The team also found that copies can learn from the ones before them. When each generation of Qwen3.5-9B inherited notes from the last, its success at setting up AI rose from 45% in the first generation to between 61% and 84% in later ones.

One thing did not help. Giving the small model a smarter AI to ask for advice made no measurable difference. Small models, the researchers found, tend not to know the right questions to ask.

Anthropic uses a real botnet as its yardstick. Kimwolf infected more than 2 million devices, mostly off-brand Android TVs.

If every group of 15 boxes in a botnet that size ran one copy of Gemma4-26B-A4B, Anthropic estimates about 133,000 copies, producing around 80,000 tokens per second in total. That is roughly the output of 40 H100 data center chips.

In plain terms, that's not a lot of computing power. The researchers describe the worm as slow, taking more than 1 to 2 days per copy of a 9B model. They compare it to a "slow, distributed digital slime mold" or "a swarm of fruit flies."

The catch: slow does not mean easy to stop. A worm spread across millions of homes has no central switch to turn off. Anthropic's own words: we should "harden our systems" and also "prepare to deal with a world where they are here to stay."

The Verge spoke with researchers outside Anthropic, and they mostly took the warning seriously.

• Jeffrey Ladish, Palisade Research: his group showed earlier this year that AI models can copy themselves to other machines. What's new, he said, is how small these models are. "I expect we'll see the first of these in the wild in the next 12 months."
• Nicolas Papernot, University of Toronto: he called the threat of AI worms "concrete" and said it "deserves immediate action," especially for hospitals and power grids.

The Verge also notes that Anthropic did not test its own Claude models, and that the company has long argued open models carry more risk than closed ones.

Not everyone is convinced. Semafor reports the warning drew sharp criticism, including from journalist Derek Thompson, who argued AI companies are part of the trend they warn about. The Verge adds that some readers saw it as hype, while the experts it interviewed did not.

For more on how AI systems behave under test, see our story on Chinese AI agents caught lying in studies.

Anthropic says defenders actually have a few advantages here.

• Traffic gives it away: a worm moving multi-gigabyte model files between devices would look unusual to internet providers' monitoring systems.
• Quarantine works: after Mirai, providers restricted infected customers to a short list of sites and sent cleanup instructions. That cleared 92% of infections within 14 days, against 74% with no notice.
• Better defaults: device makers can ship stronger security. The UK, for example, no longer allows default passwords on smart devices.

What's next: Anthropic wants manufacturers, regulators and internet providers to raise the security baseline now, before small models catch up. It says those fixes help against ordinary botnets too.

• Change default passwords: on routers, cameras, TV boxes and anything else with a login.
• Install updates: a device that never gets firmware updates is the easiest target.
• Think twice about no-name gadgets: many cheap boxes run Android versions their makers never secure.
• No need to panic: this is lab research. No AI worm has been found in the wild.