Small AI models may soon copy themselves onto the cheap devices in your office

What's new

On Oct. 12, Anthropic's Frontier Red Team, the group that tests what AI models can do in security, published research on a long-feared idea: an AI "worm" that copies itself from machine to machine and runs on the machines it takes over.

Their finding is that small AI models may be months away from doing this on everyday connected devices, like smart ovens and off-brand Android TV boxes. They named the likely first target directly: "Home and small business IoT devices." IoT, or internet of things, means anything with a network connection that isn't a computer or phone.

The story got wider coverage the next day, including from Al Jazeera.

What they actually tested

• Cheap boxes can run a real model. The team bought 15 off-brand Android TV boxes at about $55 each, networked them, and ran a 26-billion-parameter model split across them. It ran at 0.39 tokens per second, very slow but working.
• Small models can set themselves up. A 9-billion-parameter model got AI running on 8 of the 9 hardware types they tested. Models of 30 billion parameters and under can already do many of the individual steps, but make mistakes chaining them together.
• One open model did the whole cycle. Of the open-weight models tested, only GLM-5.2 replicated end to end. It spread to all 8 machines in 4 of 5 trials, and to 7 of 8 in the fifth.
• The timeline. If small models keep improving at their historical rate, the researchers project they'll reach that level by the end of 2026. They say plainly that this is only a rough estimate.

Why an office should care

Old malware needed a person to write code for each kind of device. The researchers point out that an AI replicator could figure out unfamiliar devices on its own. It also wouldn't need administrator rights, and many weak devices can simply be re-infected after a restart.

Look around a typical 150-person plant or office. A smart TV in the break room. Security cameras. A conference-room video unit. Badge readers, label printers, a thermostat, maybe a streaming box someone plugged in for the lobby. The researchers note that security cameras and video-conferencing units increasingly ship with built-in AI chips, which makes them more attractive targets.

The likely harm to you isn't a robot uprising. It's the familiar kind: your devices doing someone else's work, your network slowed, and an unwatched device sitting on the same network as your ERP, file server and customer data.

The defense against an AI worm is the same as against the last botnet. Most offices still haven't done it.

What the other side has right

• It's a lab test, not an attack. Anthropic says it doesn't yet have a full rogue replicator. Nothing like this has been reported in the wild.
• The break-in was made easy. The test devices had an open port with no password, so the researchers say the results are a ceiling on real-world success, not a forecast. In fairness, they add that past botnets like Mirai spread just by trying makers' default passwords, so real devices may not be much harder.
• It would be slow. They estimate more than a day or two per copy for a small model, a doubling time of days.
• The timeline is a guess. It rests on a trend line and one model as the benchmark.
• Consider the source. Anthropic builds AI models. Its research names an open-weight model from another company as the one that succeeded. That doesn't make it wrong, but it's worth knowing.

What helps, according to the research

The researchers point to a past botnet cleanup: when an internet provider quarantined infected customers and told them how to clean up, 92% of infections were cleared within 14 days, against 74% with no notice. They also note that default IoT passwords are now non-compliant in U.K. markets, and that better defaults from makers shrink the pool of targets.

Telling people works: a past botnet cleanup

Share of infections cleared within 14 days, when an internet provider quarantined and notified infected customers vs. when it didn't. Cited by Anthropic as the model for a first defense.

1. Quarantined and notified92%
2. No notification74%

Source: Anthropic Frontier Red Team, Oct. 12, 2026, citing earlier research on an ISP botnet cleanup.

In other words, the fixes are boring and they work. That's good news for a company without a big IT team.

What changes, and what doesn't

What to do this month

1. Make a device list. Walk the building. Everything with a network cable or Wi-Fi that isn't a PC or phone goes on it: cameras, TVs, printers, conference units, thermostats, door and badge systems, machine controllers.
2. Change every default password and turn off remote access you don't use.
3. Separate the network. Devices go on their own network or VLAN, away from the computers that reach your ERP, accounting and file shares. Guests get their own too.
4. Retire what nobody patches. No-name streaming boxes and old cameras that no longer get updates should go.
5. Ask your IT provider two questions: would we know if a device started sending unusual traffic, and who gets the call? For the wider picture, see AI hacking tools are coming for business apps.