ANTHROPIC researchers William Zhou and Daniel Freeman explored the theoretical and practical steps by which an AI-based worm might propagate across insecure devices and networks. In a set of experiments, they used a network of inexpensive Android TV boxes (about ££55 each) running a version of an open-weight model, distributed across eight off-brand devices connected together at a rate of about 0.39 tokens per second. They also ran an emulated Android network in Google Cloud Platform to test autonomous spread.
The work breaks propagation into four stages: identifying targets, gaining access to devices, setting up inference on a new device, and continuing the spread to the next target. The aim was to assess whether AI models could, in principle, act as self-propagating agents on IoT/edge devices.
Among the models tested, GLM-5.2 (40 billion active parameters) was the only one to reliably complete the end‑to‑end workflow in multiple trials, reaching up to eight nodes in several runs. Other open-weight models such as Qwen3.5-9B (nine billion) and Gemma4-26B-A4B (four billion) could perform many individual steps but struggled to coordinate end-to-end replication.
The payload used for spreading was a fixed version of Llama3.1-8B, standardised across tests to measure propagation capability rather than weight copying. The researchers note that the experiment represented an upper-bound scenario, with unauthenticated Android Debug Bridge access and ideal conditions, and thus does not demonstrate an immediate, practical threat.
Still, expert comment suggests that while practical self‑replication remains unlikely now, the possibility “will likely be necessary” to address with autonomous defensive capabilities in future.