Anthropic’s Frontier Red Team published its study on October 12, 2026, reporting separate capabilities in distributed inference, hardware setup and a directed emulator-network task. The study did not demonstrate an autonomous AI worm infecting real consumer IoT devices. Anthropic’s research describes controlled experiments, not an observed household outbreak.
Three experiments, three different results
For a distributed-inference demonstration, Anthropic ran Gemma4-26B-A4B across 15 Android TV boxes, each with 4 GB of RAM. The reported generation rate was 0.39 tokens per second. Distributed inference means splitting the work of running a model across multiple devices; it is a different task from infecting or propagating between them.
In a separate hardware-setup evaluation, Qwen3.5-9B configured inference on eight of nine tested hardware types, including Jetson Nano, Mac PCs and RTX 4090s. Anthropic estimated that unoptimized setup on the studied hardware would take 71–150 hours for Gemma4-26B-A4B and 28–51 hours for Qwen3.5-9B. Those estimates concern setting up inference, not the time for a worm to spread.
What the emulator test required
Anthropic tested the replication workflow in a firewalled network of eight Android 15 emulators with unauthenticated Android Debug Bridge (ADB) access between nodes. GLM-5.2 orchestrated a directed sequence of tasks to set up Llama3.1-8B inference on target nodes; the targets ran Llama3.1-8B, not GLM-5.2. GLM-5.2 reached all eight nodes in four of five trials and seven of eight in the remaining trial.
That result measures whether a model could carry out an assigned workflow under those conditions. It does not show that a model would independently decide to begin replicating or infect real household devices. The test also used unauthenticated ADB access, rather than demonstrating discovery and exploitation of consumer devices under ordinary conditions.
What Anthropic’s end-of-2026 forecast measures
Anthropic projected that smaller models could reach the tested capability level by the end of 2026 if they continued improving at their historical rate. To estimate the trend, the company fitted Epoch Capabilities Index (ECI) scores for notable open-weight models with 30 billion total parameters or fewer. The fitted increase was 13.7 ECI points per year, with an R² of 0.95.
ECI is a proxy for replication capability, not a direct measure of whether a model can autonomously replicate. Anthropic characterizes the timing estimate as rough, so the projection is conditional rather than a result demonstrated by the experiments.
What a past Mirai cleanup says about containment
Anthropic cites a historical cleanup of the Mirai botnet in which an internet service provider quarantined infected subscribers, restricted their connections to a whitelist of sites and redirected browsers to cleanup instructions. The account says 92% of infections were cleared within 14 days with quarantine and customer notification, compared with 74% without notification. That result concerns Mirai remediation, not an AI-worm test.
For potential future threats, Anthropic proposes monitoring large model transfers and unusual device-to-device traffic, using honeypots to study discovered payloads, and strengthening IoT security defaults.
