An AI worm is a self-spreading program that uses an AI model, rather than only fixed code, to find new systems, get onto them and keep spreading. The idea is not new in research, but it drew fresh attention on 12 October 2026, when Anthropic published experiments suggesting that small AI models may be months away from being able to replicate across cheap, poorly secured IoT devices such as smart TV boxes.
Worms, AI worms and the two kinds studied so far
A traditional computer worm copies itself from one machine to the next without anyone clicking anything. Researchers have described two quite different "AI" versions of this idea:
- Prompt-based worms. In 2024, researchers from Technion and Intuit described Morris II, a self-replicating prompt that spread between AI email assistants in a lab setup by being stored and retrieved as context, then copied into new emails. No model weights moved; the attack rode on how the applications passed text around.
- Weight-based replicators. Anthropic's October 2026 research looks at an AI agent that carries a model with it, installs it on a compromised device and runs it there, so the infected hardware supplies the computing power for the next hop.
What Anthropic's research tested
Anthropic's researchers split replication into four stages: finding targets, gaining execution, establishing inference (getting a model running) and continuing to spread from the new host. They focused mainly on the inference step, citing earlier studies on the hacking stages. Reported findings include:
- A 26B-parameter open-weight model (Gemma4-26B-A4B) ran across 15 off-brand Android TV boxes, bought for about US$55 each, at 0.39 tokens per second.
- A 9B model managed to set up a model server on 8 of the 9 hardware types tested.
- In a simplified test on 8 emulated Android nodes in an isolated cloud network, GLM-5.2 was the only open-weight model in the set that reliably completed the full cycle. It reached all 8 nodes in 4 of 5 trials and 7 nodes in the fifth.
- Based on a trend in a general capability index, Anthropic estimated that a small model could reach GLM-5.2's level by the end of 2026, and called this a rough estimate.
What it did not show
The limits matter as much as the headline. In the full-cycle test, the "hacking" step was deliberately trivial: devices exposed an Android debugging port (ADB) with no authentication, which Anthropic describes as an upper bound on real-world success. The worm models also served a standard smaller model (Llama3.1-8B) on each node rather than copying their own weights. Anthropic states that it does not yet have a full rogue replicator, and that the model sizes able to run on such devices and the capability level needed to replicate do not yet overlap. Its speed estimates also point to a slow spread: roughly 28 to 51 hours for a 9B model to finish setup on TV-box-class hardware in its tests. Some security commentators quoted in media coverage have questioned how urgent the threat is.
Why it matters for businesses
The research rests on an old weakness: many connected devices ship with weak defaults, exposed services and rare updates. Anthropic points to past botnets such as Mirai, which spread using default manufacturer usernames and passwords. It also notes that a replicator spread over many devices may have no single point to switch off. In business settings the relevant equipment can include IP cameras, meeting-room units, NAS boxes, smart TVs in shops or lobbies, and building sensors. API keys used by AI tools are another route Anthropic mentions, as stolen credentials could let a replicator run on paid services.
Practical steps to take now
- Keep an inventory. List every connected device, its owner, firmware version and what it can reach.
- Remove default credentials and close debug services. Change factory passwords and disable remote debugging such as ADB unless there is a clear need.
- Segment the network. Put IoT devices on their own network segment and block device-to-device traffic they do not need, in line with zero trust principles.
- Update or retire. Patch firmware regularly and plan to replace devices that no longer receive updates.
- Watch traffic patterns. Anthropic notes that weight-based replicators would likely create unusual signals, such as multi-gigabyte downloads to small devices and sustained traffic between devices.
- Protect AI keys and agent permissions. Store API keys in a secrets manager, rotate them, use MFA on admin and cloud accounts, and give AI agents only the access a task needs.
Illustrative example: A small office has two IP cameras, a meeting-room screen and a NAS on the same Wi-Fi as staff laptops. Moving the devices to a separate segment, changing default passwords and alerting on large unexpected transfers would shrink the attack surface for both conventional botnets and any future AI-driven ones. This is a hypothetical scenario, not a description of a specific client.
If you want a structured review of devices, cloud settings and AI workflows, see our Cybersecurity & Compliance service.
Frequently asked questions
Are AI worms spreading on home or office devices today?
Anthropic's research does not report one. It says it does not yet have a full rogue replicator and that its end-to-end test used simplified, unauthenticated access in an isolated network.
Is the end-of-2026 date a firm prediction?
No. Anthropic based it on a trend in a general capability index, which it describes as only a proxy for replication ability, and calls the timing a rough estimate.
How is Morris II different from the Anthropic research?
Morris II spread as text through AI email assistants by exploiting prompt injection. The Anthropic work studies agents that install and run a model on compromised hardware.