Anthropic researchers have demonstrated pieces of a possible self-spreading AI system, but the experiment did not create a worm that could compromise ordinary devices in the wild. The work instead tested whether models could establish inference across low-cost hardware and whether an agent could copy a model between deliberately accessible nodes.
In one part of the study, a distributed version of Gemma4-26B-A4B ran across 15 generic Android television boxes. The setup managed inference at 0.39 tokens per second. That result shows that layers of a model can be divided among inexpensive devices, but the low speed and conspicuous data transfers would limit usefulness and could make a growing network easier to spot.
A separate test used Z.ai's GLM-5.2 to propagate Llama3.1-8B across eight Google Cloud instances running Android 15 emulators in a private network. The model reached all eight nodes in four of five trials and seven in the remaining trial. Other open-weight models tested by the researchers reportedly failed reliably, although the published account did not specify how many alternatives were evaluated.
The result comes with major qualifications. The nodes were configured for the project and left open to the replication process. Anthropic largely excluded the problem of finding and exploiting security flaws, relying on earlier research to support the premise that models can perform some cyber-exploitation tasks when given suitable tools. A custom harness called Memento also assisted the scenario. The researchers described this simplified environment as an upper bound on likely real-world success.
The projected threat therefore depends on several conditions: smaller models would need to gain stronger end-to-end capabilities, those abilities would have to fit into a compact model, and an attacker would still need a workable route into vulnerable devices. Anthropic estimated that a hypothetical network might take days to double, far slower than the roughly hourly growth associated with the Mirai botnet in 2016.
The practical lesson is narrower than the prospect of an autonomous AI worm. Weakly secured internet-connected devices remain potential botnet hosts, and future agents could automate more steps of an attack. Basic defenses—including timely patches, removal of default credentials and monitoring for unusual bandwidth use—would still obstruct the scenario tested. Anthropic's experiments establish technical building blocks under controlled conditions, not evidence that self-replicating AI botnets are currently spreading. The gap between a laboratory workflow and an uncontrolled outbreak remains substantial: replication, exploitation, persistence and evasion would all need to work together on varied hardware without the researchers' prepared environment.
