How close are we to AI that copies itself?

The news, read at the source

"AI models self-replicate on IoT devices", the Italian site Punto Informatico ran as its headline.¹ The headline is stronger than the research behind it. On 12 October Anthropic's Frontier Red Team, the group that measures model risks before they become real problems, published a set of experiments with a more precise conclusion: small models may be only months away from being able to copy themselves onto smart ovens and off-brand TV boxes.²

In my work the difference between "it happens" and "it may happen soon" decides whether a company reacts or prepares. Here it is worth preparing, and to do that well you have to look at what was actually measured.

They bought 15 Android TV boxes at about 55 dollars each, networked them and ran Gemma4-26B-A4B across them, a 26-billion-parameter model split into pieces over the devices. It is slow, 0.39 tokens per second, but it works. Then they asked various open models to install an AI engine on hardware they had never seen: a 9-billion-parameter model managed it on 8 of 9 device types. Finally they built a small test network of 8 Android nodes: only GLM-5.2, a larger model, completed the whole cycle on its own, that is finding the device, copying itself, starting up and moving on, across all 8 nodes in 4 trials out of 5.

The authors state a limit: in the test network the cyber-attack part was deliberately easy, because the devices accepted connections without a password. That makes the result an upper bound. But they add a detail that makes the bound less reassuring: many real devices are just as open. Tracking the progress of small models, they estimate that small models will reach GLM-5.2's level by the end of 2026.

Why home devices

A worm is a program that copies itself from one computer to the next without anyone launching it. Until now an AI worm seemed to need the expensive processors of data centres. Anthropic's experiment shows that many cheap, poorly protected devices put together are enough: fridges, ovens, robot vacuums, cameras, TV boxes. Some already carry a small AI chip.

It has already happened with a traditional worm. In January Synthient counted more than 2 million devices infected by the Kimwolf botnet, two thirds of them Android TV boxes sold online by third-party merchants. Many left the factory with a debug port open that accepts connections without authentication, and some arrived already infected.³ Ten years ago Mirai did the same with cameras and video recorders protected by factory passwords, about sixty combinations in all, and on 21 October 2016 it made sites such as Twitter, Netflix and Reddit unreachable for hours by attacking the Dyn service.⁴

I know these objects well: they are the same fast tech I have written about, bought in a hurry, paid little for and never updated. An off-brand 50-euro TV box with no updates costs its buyer little, but its security cost is paid by all of us.

No invention stays what it was born for.

Sixth law of innovation, from Un perché alla volta (translated)

A TV box is made for watching films. Networked with fourteen others, it becomes part of a computer able to host an artificial intelligence.

Worms and artificial intelligence, over forty years

1. 1988The Morris worm, the first to spread across the internet, slows down or stops thousands of computers.⁵
2. 2016Mirai uses the factory passwords of cameras and video recorders to attack Dyn.⁴
3. Mar 2024Cornell Tech researchers show Morris II, a worm that spreads between AI-based email assistants.⁶
4. Dec 2024At Fudan University two open models create a working copy of themselves in 50% and 90% of trials.⁷
5. Jan 2026Kimwolf has infected more than 2 million devices, mostly Android TV boxes.³
6. Oct 2026Anthropic estimates that a small model may be only months away from replicating on its own across IoT devices.²

A slow worm that learns

Such a worm would be slow. On the test TV boxes, starting the model on a new device takes 28 to 51 hours for a 9-billion-parameter model and 71 to 150 hours for the 26-billion one. The authors compare it to a slime mould, spreading over days rather than seconds. They also did a sum: a fleet the size of Kimwolf could host about 133,000 copies of the model, together worth the computing power of some forty data-centre processors. That is little, but it is spread everywhere and has no central switch to turn off.

The part that strikes me most is another one: the worm learns. In one experiment each copy left the next a note on what it had tried and where it had gone wrong. After six generations the success rate in starting the model had risen from 45% in the first to between 61% and 84%. A traditional worm always makes the same moves. This one can adapt to devices it has never seen.

Learning from the mistakes of earlier copies

First generation45%

Later generations, lowest value61%

Later generations, highest value84%

There is also a result pointing the other way. Giving a small model the help of a much more powerful one did not improve it: small models do not know which questions to ask. According to the authors, a likelier scenario is the reverse, a large model coordinating many small ones as workers.

Defenders still have the edge

For now defenders start ahead, and the research says so clearly. A worm copying models of several gigabytes leaves obvious traces in network traffic, visible to internet providers. The faster it spreads, the more it stands out. Once it is found, decoy devices, honeypots, make it possible to capture and study it.

Against Mirai what worked best was action by providers: quarantining infected connections and alerting customers with instructions to clean their devices. With quarantine and an alert, 92% of devices were cleaned within 14 days.²

Devices cleaned within 14 days after a Mirai infection

With provider quarantine and a customer alert92%

Without an alert74%

Then there are the rules. Since 29 April 2024 connected devices with the same default password for everyone can no longer be sold in the United Kingdom.⁸ In Europe the Cyber Resilience Act requires manufacturers, from 11 September 2026, to report within 24 hours vulnerabilities exploited in their products, and from 11 December 2027 it will make security requirements mandatory for everything that connects to a network.⁹

Rules help, but the weak point is still the one Kimwolf exposed: devices sold online by faceless merchants that no rule really reaches. That is why I think responsibility should extend to whoever puts them on sale, marketplaces included.

What I would do now

I see no reason for alarm, because this worm does not exist today. But the timescale Anthropic indicates is short, and the vulnerable devices are already in our homes. I recommend four actions, all simple, and they are worth taking before they are needed.

1. At homeNo off-brand boxesA TV box without updates is the ideal target. Better a product with stated support and updates.
2. On the networkKeep devices apartTVs, cameras and appliances on a guest Wi-Fi network, away from computers and phones.
3. At workInventory and trafficKnow which devices are connected and notice when one downloads gigabytes it should not.
4. SellersAnswer for securityReal passwords, updates for years, a channel to report vulnerabilities. The Cyber Resilience Act points this way.

For twenty years we have treated the security of connected objects as someone else's problem, because a human attacker had no time to bother with millions of small devices. A program working on its own, day and night, has that time. The moment to fix the basics is now, while small models are still below the threshold Anthropic has measured.