Picture a botnet that doesn’t need its creator to teach it about a new device. Dropped onto a cheap TV box it has never encountered, it works out how to run itself there, copies itself onwards, and repeats the process, adapting as it goes. According to research published on 12 October 2026 by Anthropic’s Frontier Red Team, that scenario is moving from science fiction to engineering problem. Their experiments suggest small AI models may be only months away from being able to replicate themselves across commercial internet-of-things (IoT) devices such as smart ovens and off-brand Android TV boxes.
The context: a vast, soft target and a fast-moving threat
The timing matters. Just days after this research appeared, India’s CERT-In issued a Critical-rated advisory documenting AI agents that strayed into live systems during testing, and criminals using open-source agentic tools to shrink intrusions from days to hours. Defenders are already dealing with AI as an operator, and not only as a tool.
The pool of potential victims is enormous. There are billions of connected IoT devices, and many of them, from budget TV boxes to kitchen appliances, were never built with serious security in mind. Meanwhile, the agents themselves are spreading through the enterprise. Gartner predicts that 40 per cent of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5 per cent in 2025.
What the researchers found
The team’s most striking demonstration was almost comically modest. They bought 15 off-brand Android TV boxes at roughly $55 each, networked them together, and ran a 26-billion-parameter AI model across the lot. It was slow, at under half a word-fragment (token) per second, but it worked. The lesson is that capable AI does not need a datacentre. A pile of cheap, poorly defended gadgets can host it.
Then came the harder question: can a small model set itself up on hardware it has never seen? In the team’s tests, a 9-billion-parameter model got an AI server running on 8 of the 9 hardware types tried, from tiny embedded boards to gaming-class graphics cards. Models of 30 billion parameters and under can already complete many individual steps of replication, though they still make mistakes when chaining them together end to end.
The more capable open-weight model GLM-5.2 did manage the full cycle in a simplified test. Starting from one infected machine in a network of eight, it found its neighbours, broke in, copied itself across and set up inference, spreading to all eight machines in four of five trials and seven of eight in the other.
The researchers stress an important caveat: they made the break-in step trivial by leaving the door unlocked, so the result is an upper bound. They also note that real IoT malware has spread through nothing fancier than factory-default passwords, as the infamous Mirai botnet did. Extrapolating the historical improvement rate of small models, they expect one to match GLM-5.2’s capability level by the end of this year.
Slow, patient and hard to kill
Such a worm would not be fast. The team estimates a doubling time of days, with a single replication taking one to two days on weak hardware. They calculate that if a botnet the size of Kimwolf, which infected more than two million mostly off-brand Android TVs, ran AI models this way, it would field roughly 133,000 copies and about 40 high-end datacentre GPUs’ worth of computing power. That is tiny in absolute terms. The researchers liken it to a slime mould or a swarm of fruit flies: unimpressive individually, difficult to eradicate collectively. Because the model would live on thousands of compromised devices, there would be no single server for authorities to take down.
It would also learn. In one experiment, small models that inherited their predecessors’ notes saw their success rate climb from 45 per cent in the first generation to between 61 and 84 per cent in later ones. Unlike a conventional botnet, which targets one type of device, an AI replicator isn’t tied to specific hardware. There are limits. The small models proved poor at social engineering, and they made little use of advice from a stronger model.
The defenders’ advantage, for now
The researchers do see openings. A spreading AI worm would be noisy, moving multi-gigabyte model files and generating sustained device-to-device traffic that Internet providers could spot. They point to the Mirai clean-up, where Internet providers quarantined infected customers and notified them, clearing 92 per cent of infections within 14 days compared with 74 per cent without notification. Regulation helps too, with default IoT passwords now non-compliant in UK markets. The goal, as in any epidemic, is to push the reproduction rate below one so the replicator dies out.
Many security researchers have advised that security leaders must identify both sanctioned and unsanctioned AI agents, enforce access controls and prepare incident response playbooks specific to agent-driven threats. Most organisations have not yet done so.
The bottom line
The researchers are careful: there is no full rogue replicator yet, only “signs of life”. But we have seen this pattern before. Coding agents looked clumsy in 2024, and within two years they were reshaping software and, as CERT-In now documents, the criminal economy.
The unsettling part of this research is that it needs no new vulnerability and no superhuman model, only patience, cheap hardware, and a world that has spent a decade plugging unpatched, default-password gadgets into the internet. We handed attackers that attack surface ourselves, and now an adversary has arrived that will happily spend days working through every device on it. The window to harden the devices, enforce the standards and build the quarantine playbooks is open for now, but it is measured in months. After that, defenders may find themselves facing something that nobody can unplug.