TL;DR
Anthropic tested AI running on cheap TV boxes and replication in a separate contained network. It didn’t demonstrate a complete AI worm spreading through homes.
If malicious software can run its own model, closing a model-provider account won’t stop that local copy. Defenders would need to isolate and clean up the machines running it.
Check which devices you own, whether they still receive updates and what they can reach on your network.
The unsettling part of an AI worm is where you’d have to go to turn it off.
A computer worm is software that copies itself from one machine to another. An AI agent uses a model to choose actions and tools to carry them out. Put the two together, and the software could bring a model along when it spreads. In a June research preprint, a paper released before peer review, Jonas Guan and colleagues tested an adaptive worm in a contained network. The software used a downloadable model rather than a commercial AI service.
If an agent needs a provider to answer every request, disabling its access can cut off that source of answers. But a downloadable model comes as files that compatible software can use to produce answers locally. With those files and enough hardware, the agent doesn’t need the provider to answer its requests. Closing an account elsewhere doesn’t remove software from the machines already running it.
That’s the possibility I want to understand. It doesn’t require a model to be conscious, afraid of being shut down or secretly planning anything. Software instructed to copy itself can cause trouble without having “feelings” about the assignment.
Two experiments, with a gap between them
In Anthropic’s October 12 report, William Zhou and Daniel Freeman describe running one downloadable Gemma model split across 15 Android TV boxes costing about $55 each. Together, the boxes produced 0.39 tokens per second. Tokens are pieces of text.
Replication used eight cloud machines imitating Android devices, with deliberately easy access. A stronger model, GLM-5.2, ran separately and installed a smaller model. The test launched more agents after successful setup. GLM wasn’t copying and running itself on those physical TV boxes.
The tested models small enough for that hardware didn’t reliably complete the whole job. To be clear, Anthropic’s prediction about what could happen soon isn’t an observed outbreak.
Several weak machines can do one larger job
Sharing a model across computers isn’t new. The Petals research showed how people could combine their hardware to run large models. Each participating machine holds part of the model and handles part of the calculation. Information passes between them until the system produces an answer.
That has legitimate value. Researchers can work with a model they couldn’t fit on one computer. A device doesn’t have to be powerful on its own to contribute to something larger. The question here is whether its owner agreed to contribute it.
In No Control Plane, I wrote about software continuing to coordinate after its central manager exits. That article concerned authorized operations with defined targets. Here, the concern is a model running on hijacked hardware, with no cooperating operator who will honor your stop request. Removing a central dependency can help software survive a failure. It can also remove a place defenders hoped to interrupt malicious software.
The June worm study deserves the same care as Anthropic’s newer tests. In its main spread tests, copied agents sent requests for model output back through earlier copies to the original attacker machine, which forwarded them to a shared pool of model servers. Those tests still depended on that original machine. Separate trials tested getting the model running on newly reached machines, with administrator credentials supplied in advance. Every target was deliberately vulnerable, without antivirus or active firewalls. This was a laboratory demonstration, not a measurement of success against a well-defended business.
The hijacked-device problem is already here
We don’t need to wait for an AI worm to care about the hardware. In June 2025, the FBI warned about BADBOX 2.0, a network of compromised devices that criminals could use without their owners’ knowledge. Some devices arrived with malicious software. Others acquired it through downloads during setup. The affected products included TV streaming boxes and digital picture frames.
That’s ordinary malware, not evidence of AI replication. But it establishes the existing problem: a product can keep doing its visible job while someone else uses its computer and internet connection.
The FBI’s warning includes suspicious app stores, requests to disable Google Play Protect and unexplained internet traffic. It also cautions that one indicator alone doesn’t establish an infection.
Start with the devices you can actually control
For a home or small office, I’d start with the connected-device list in the router. Match the entries to things you recognize. An unfamiliar name is something to identify, not proof of an attack.
Then check the manufacturer’s support page. Is the device receiving security updates? When does support end? The UK’s National Cyber Security Centre recommends checking support periods, installing updates and turning off remote access when you don’t need it. A cheap device with no remaining support is a different purchase from a cheap device that someone still maintains.
Keep devices that don’t need access to your work computers on a separate network. The Canadian Centre for Cyber Security explains how a guest network can separate smart devices from your primary network. Check your router’s settings before relying on that separation. Some systems let you choose devices to share across the boundary; Google’s guest-network documentation is one example. A second network name alone doesn’t tell you which machines can still talk to each other.
If you suspect a device is compromised, the FBI recommends considering disconnecting it from your network. Disconnecting it doesn’t remove the malware, but it cuts off that connection while you investigate (containment and exposure control.)
Those steps reduce opportunities for existing malware too. They aren’t a promise that every future AI attack will fail, and they don’t require deciding whether Anthropic’s timeline is right.
In Kill Conditions, I asked what should stop an agent before it takes an irreversible action. That assumes you control the machinery enforcing the stop. A copy running on a stranger’s device asks something harder: who can reach that machine, restrict its connections and remove the software?
Before relying on a provider’s shutdown button, find out what still needs that provider. An account can be disabled while downloaded software keeps running. Your response plan needs to reach the computers doing the work.
Resources
Anthropic: AI models may be capable of self-replicating without access to a datacenter, October 12, 2026. Separate hardware and replication experiments, with explicit limitations.
Guan and colleagues: AI Agents Enable Adaptive Computer Worms, June 2, 2026. Preprint; see sections 3.4, C.2 and C.3 for test limits and model-hosting arrangements.
Borzunov and colleagues: Petals. Collaborative model execution across participants’ hardware.
FBI: Home Internet Connected Devices Facilitate Criminal Activity, June 5, 2025. BADBOX 2.0 indicators and precautions.
National Cyber Security Centre: Smart devices, using them safely in your home. Support periods, settings and updates.
Canadian Centre for Cyber Security: Guest Wi-Fi. Separating guest and smart devices from the primary network.
Google: Create, edit and share a guest Wi-Fi network. Check which devices remain shared.