- Inside Anthropic’s AI Replication Experiment
- Hardware, Models and Test Parameters
- Why the 9B Model Matters More Than the Bigger Demo
- Where Today’s Models Still Fall Short
- The Worm Reached 8 Nodes — But the Test Was Simplified
- What AI Changes Compared With Conventional Malware
- Early AI Worms Would Spread in Days, Not Seconds
- A Million Cheap Devices Can Still Form Useful Compute
- Cameras and Edge AI Hardware Are the More Realistic Targets
- The Missing Piece: A Fully Autonomous Worm in the Wild
The company has not observed a fully autonomous AI worm in the wild. Its experiments show that several required components already work.
We’re seeing signs of life for AI worms, Anthropic researchers wrote.
Inside Anthropic’s AI Replication Experiment
Anthropic tested autonomous replication and adaptation, or ARA.
The process includes four steps:
- Find a target device.
- Gain code execution.
- Configure AI inference on the new hardware.
- Start another agent and continue propagation.
The experiments focused mainly on the third step: getting AI inference running on different hardware and operating systems.
Hardware, Models and Test Parameters
| Component | Anthropic experiment |
| Small model | Qwen3.5-9B |
| Model size | 9B parameters |
| Hardware setup success | 8 of 9 platforms |
| Distributed model | Gemma4-26B-A4B |
| Parameter count | ~26B |
| Android TV boxes | 15 |
| RAM per box | 4 GB |
| Approx. cost per box | $55 |
| Quantization | 4-bit |
| Inference method | Pipeline parallelism |
| Demonstrated speed | ~0.39 tokens/sec |
| Replication test network | 8 Android nodes |
| Replication model | GLM-5.2 |
| Target payload | Llama 3.1 8B |
Anthropic ran Gemma4-26B-A4B across 15 low-cost Android TV boxes using pipeline parallelism. Qwen3.5-9B successfully configured inference on eight of nine tested hardware platforms.
Why the 9B Model Matters More Than the Bigger Demo
The 26B demonstration proves that a larger model can run across multiple cheap devices. The 9B result is more relevant to autonomous malware because smaller models are easier to deploy on constrained hardware. The current limit is reliability. Small models can complete many individual steps but still fail on longer autonomous workflows.
Where Today’s Models Still Fall Short
An autonomous AI worm needs two things at the same time:
- a model small enough to run on edge hardware;
- a model capable enough to complete the full replication chain.
| Model | Current capability | Limitation |
| Earlier small agents | Basic commands and cyber tasks | Weak long-horizon autonomy |
| Qwen3.5-9B | Configures inference on 8/9 tested platforms | Not reliable enough for full replication |
| Gemma4-26B-A4B | Runs across cheap IoT hardware | Very slow |
| GLM-5.2 | Completes simplified replication workflow | Too large for the intended IoT footprint |
Anthropic argues that the risk increases when these two thresholds meet.
The Worm Reached 8 Nodes — But the Test Was Simplified
Anthropic created an isolated network of Android 15 emulators in Google Cloud. One node acted as the starting point. The agent had to find another node, connect to it, transfer the payload, configure inference and continue.
GLM-5.2 reached all eight nodes in four of five runs. The main caveat: the target machines exposed an unauthenticated ADB port. The agent did not need to discover or exploit a difficult vulnerability.
The result shows autonomous propagation under simplified conditions, not real-world internet compromise.
What AI Changes Compared With Conventional Malware
| Traditional worm | AI-powered worm |
| Executes predefined logic | Can reason about unexpected conditions |
| Targets known environments | Can adapt to unfamiliar hardware |
| Uses fixed exploit logic | Can select or modify techniques |
| Static configuration | Can rewrite scripts and settings |
| Often stops on failure | Can troubleshoot and retry |
The key difference is adaptation, not simply the presence of an LLM.
Early AI Worms Would Spread in Days, Not Seconds
Anthropic measured Gemma4-26B-A4B at roughly 0.3–0.39 tokens per second on low-cost distributed hardware.
Estimated setup time:
- Gemma4-26B-A4B: about 71–150 hours;
- Qwen3.5-9B: about 28–51 hours.
That means an early AI worm would likely replicate over hours or days rather than seconds.
A Million Cheap Devices Can Still Form Useful Compute
Anthropic uses large IoT botnets as a reference case. If two million compromised devices were grouped in clusters of 15, they could theoretically host about 133,000 model replicas.
The total compute would still be modest compared with modern GPU infrastructure, but it would be geographically distributed and difficult to disable centrally.
Cameras and Edge AI Hardware Are the More Realistic Targets
The most relevant devices are those that already contain AI accelerators or enough memory to run compact models.
Potential targets include:
- security cameras;
- videoconferencing hardware;
- robots and drones;
- vehicles;
- embedded AI systems.
These are more technically relevant than low-power appliances such as ovens or basic smart-home sensors.
The Missing Piece: A Fully Autonomous Worm in the Wild
Anthropic demonstrated that:
- small models can configure inference on varied hardware;
- larger models can run across multiple cheap IoT devices;
- capable agents can autonomously propagate in a simplified network.
It did not demonstrate a compact model independently finding vulnerable consumer devices on the public internet, exploiting them, installing itself and continuing to spread.
The current risk is not an existing AI worm. It is that the components required to build one are becoming technically feasible.
