Anthropic’s October 12, 2026, study reports separate demonstrations of AI inference on inexpensive Android TV boxes and a simplified replication workflow on Android emulators. It does not demonstrate a complete small-model worm operating across real consumer devices. The findings and their limits are set out in Anthropic’s research.
A computer worm copies itself from one machine to another without human input. Anthropic examined whether AI agents could help establish model inference on compromised devices and continue propagating. Its experiments tested different parts of that idea, with different models and hardware.
What Anthropic tested
Anthropic ran Gemma4-26B-A4B across 15 off-brand Android TV boxes, reporting a combined inference speed of 0.39 tokens per second. In a separate evaluation, Qwen3.5-9B set up inference on 8 of 9 hardware types for the Llama3.1-8B payload. These results address running models across devices and adapting setup to different hardware; neither is the emulator replication trial.
For that trial, GLM-5.2 orchestrated a workflow across eight Android 15 emulator nodes hosted on Google Cloud. It reached all eight nodes in four of five trials and seven nodes in the fifth. Llama3.1-8B was the payload set up on the nodes; GLM-5.2 ran separately as the agent. The Android Debug Bridge (ADB) port had no authentication, making the access step deliberately easy.
Anthropic’s projection that small models might reach the tested capability level by the end of 2026 was a rough estimate conditional on continued historical improvement. The company used its Epoch Capabilities Index as a proxy for replication ability. Its estimated inference-setup trajectories were 28–51 hours for Qwen3.5-9B and 71–150 hours for unoptimized Gemma4-26B-A4B. Those are setup estimates, not observed times for a worm to spread between real devices.
Network signals and responses
Anthropic identifies unusually large model transfers, sustained device-to-device traffic, scanning, and outbound connections as possible network signals. The report also discusses honeypots, network quarantine, customer notification, and stronger default security for devices. These are measures Anthropic proposes for defenders to consider, not outcomes tested in the emulator workflow.
The practical point is that the scenario depends on more than model capability: devices must also be reachable and able to exchange data. Monitoring unusual transfers and traffic patterns is among the network-level responses Anthropic identifies, while quarantine and customer notification address what a response could involve.
What the Mirai comparison measures
Anthropic cites a prior internet service provider remediation effort in which 92% of Mirai infections were cleared within 14 days with quarantine and customer notification, compared with 74% in the group without notification. The figures describe historical Mirai cleanup, not an AI-worm trial or a measured result for current defenses.
Why Anthropic studied the scenario
Anthropic says it focused on small, weight-based replicators because it considered them a near-term threat model that could be investigated directly. In a separate Frontier Red Team overview, the company says its evaluation work helps it advance AI while developing safeguards.
