An AI worm reached all eight machines in a sealed test. Is your security ready for what that means?

What the experiments did

• Ran Google's Gemma4-26B-A4B model split across 15 off-brand Android TV boxes (about $55 each, 4GB of memory) at 0.39 tokens per second.
• Tested whether open-weight models could get a model running on unfamiliar hardware. A 9B model did so on 8 of 9 hardware types. The post names Qwen3.5-9B among small models that managed this on hardware "from Jetson Nanos to Mac PCs and RTX 4090s".
• Ran a "simplified" end-to-end test. A worm hopped across eight emulated Android machines in a sealed-off cloud network, through a port that required no password, and had to set up a separate 8B model (Llama3.1-8B), not itself. Only GLM-5.2 completed the task, reaching all eight machines in four of five trials and seven in the fifth. The worm's own model ran on an outside server because the test machines were too small to host it.
• GLM-5.2 is not a small model. Z.ai (formerly Zhipu AI) released it as open weights under an MIT licence in June 2026, listed at 744 billion parameters 23. Anthropic's argument is that a future small model with GLM-5.2's ability could do the same.

Anthropic states its own limits

The hacking step was kept "trivial", which makes the result "an upper bound on real-world success", although it notes that past botnets such as Mirai spread using default passwords. It expects a TV-box replicator to be slow ("over 1-2 days per 9B replication") and to leave traffic patterns internet providers could spot. It lists quarantine by providers and secure-by-default products as defences, and says: "We don't yet have a full rogue replicator" 1.

Prior work

"Autonomous replication and adaptation" was framed by the Alignment Research Center's evaluations team, now METR. In 2023 it found that agents could complete only the easiest of 12 such tasks 4. (Conflict flag: METR is now embedded at Anthropic and co-wrote source 5.) In December 2024, Fudan University researchers reported that agents built on Llama3.1-70B and Qwen2.5-72B made a working copy of themselves in 50% and 90% of ten trials when told to "replicate yourself" 6. Morris II (March 2024) showed a worm built from self-replicating prompts spreading between AI email assistants 7. The "prior work" Anthropic links on AI agents acting as worms is a June 2026 paper, "AI Agents Enable Adaptive Computer Worms," whose worm spread across Linux, Windows and IoT machines on a test network 8.

Reactions

Michael Bailey (Georgia Tech) told Scientific American, "We already had self-replicating malware … We had botnets," and cautioned against "fearmongering". Vyas Sekar (Carnegie Mellon) called these "classical computer security threats" but warned of a "democratization of being evil" 9. Jonas Guan, a co-author of the June 2026 paper, told the Guardian that an AI worm should not top anyone's list of fears and that Anthropic's version moves very slowly. Juan Andres Guerrero-Saade of SentinelOne called it "nifty stunt hacking". Joshua Saxe, who led Meta's AI security effort, said the security community is not taking such risks "as seriously as they should be" 10. Anthropic sells AI models, including the frontier model it used as an "advisor" in one test (Opus 4.8). The models tested as worms were open-weight models from other developers. The post does not link its findings to Anthropic's Responsible Scaling Policy 111.