Microwaves and fridges will take over the world. Almost

01 A regular worm follows instructions. An AI worm improvises

In cybersecurity, a worm is a program that moves from one computer to another on its own: it finds a vulnerable device, copies its code there, runs, and looks for the next one. No human needed. These programs are decades old, and the world has seen plenty of worm outbreaks.

But a classic worm has a ceiling: it can do exactly what its author built into it. Ten infection methods planned means ten methods available. Meet an unfamiliar system, and it won't invent an eleventh on its own.

Now replace the hard-coded algorithm with a language model — the same kind that writes our code and fixes our bugs today. It can study an unfamiliar device, work out its software, hit an error, "think it over," and try again. Anthropic puts it this way: unlike ordinary malware, a thing like this can figure out unfamiliar devices by itself.

And one more detail that stuck with me. In an AI worm, the model's weights are part of the payload. The worm carries its "brain" with it (or re-downloads it from a public hub) and runs it right on the captured hardware.

02 How do you fit a neural net into a $55 TV box?

The obvious question: modern models need data centers, GPUs, and a power plant of their own. How does that fit into a little box sitting under your TV?

Answer: it doesn't. And it doesn't have to fit whole. The researchers bought 15 no-name Android TV boxes at roughly $55 each with 4 GB of memory, networked them, and spread the Gemma4-26B-A4B model across them. Each box holds just a couple of the model's layers and passes the result to the next — like an assembly line in a factory.

Why is this even possible? Gemma4-26B-A4B is a "mixture of experts" architecture: of its roughly 25 billion parameters, only about 4 are active per token. Add 4-bit weight compression. By Anthropic's math, under those conditions a 9-billion model is handled by 4 boxes, and a 26-billion one by 10 or more.

The speed came out to 0.39 tokens per second. In human terms: for a thousand-token answer you'd wait about 40 minutes. As a chatbot — a disaster. You could cook dinner, eat it, and do the dishes.

But here's the nuance. A worm doesn't need to chat with a human. It can poke around a system for days, and nothing is rushing it. For an autonomous program, slow doesn't mean useless. And there are millions of these "useless" little boxes in the world.

03 The experiment: eight devices and one very determined GLM

Running a model on cheap hardware is only half the job. The real question: can an AI complete the full replication cycle on its own? Anthropic broke it into four steps:

1. Find a new device on the network.
2. Get the ability to run code on it.
3. Bring up a working model on it.
4. Continue spreading from the new device.

For the test, they built an isolated network of 8 cloud nodes running an Android 15 emulator. The worm starts on "patient zero" and has to infect the rest.

Now two caveats, without which the retelling turns into a horror story. First: entry to the devices was made as easy as possible — the Android debug port was open with no password. So they were testing not the ability to break in, but the ability to orchestrate the whole process. Second: new nodes ran a small Llama3.1-8B, while GLM-5.2 itself ran on a separate server because it didn't fit on the nodes. That was done deliberately, to compare models on equal footing.

The result: of all the open models tested, only GLM-5.2 completed the full cycle. It infected 8 nodes out of 8 in four attempts out of five, and reached 7 in the fifth. The other models consistently failed at one step or another.

And here's why the "open port" caveat is less reassuring than you'd hope. The legendary Mirai botnet once spread simply by guessing factory logins and passwords. And in the Kimwolf botnet, most infected boxes shipped from the factory with that very open debug port. Real-world IoT security is sometimes not far from the experiment's "simplified conditions."

04 The floor and the ceiling: when they meet

Anthropic frames the problem with a neat metaphor. A worm has a "floor" — the minimum level of smarts below which it can't manage to replicate. And a "ceiling" — the maximum size at which a model still fits into cheap devices.

GLM-5.2 is above the floor but too big. Qwen3.5-9B and Gemma4-26B-A4B fit under the ceiling but aren't smart enough yet. Today the floor and the ceiling don't meet.

Now the unpleasant part. The researchers plotted the progress of open models up to 30 billion parameters, and they are steadily getting smarter. If the pace holds, a small model will reach GLM-5.2's level by the end of 2026. That is, in a couple of months.

Important: this is a forecast, not a doomsday date. A model's overall capability rating is only a rough proxy for its ability to replicate, and the authors themselves call the estimate crude. But a couple of years ago a chart like this would have looked like science fiction, and now it's a tidy straight line.

05 An AI that learns from its copies' mistakes

For me, this is the most intriguing part of the research. A regular worm trips over an error and that's the end of the story, unless the author planned a backup. But what if every copy leaves the next one a note: "I tried this, it broke here, don't do it this way"?

Anthropic tested exactly that. The Qwen3.5-9B model repeatedly tried to bring up an AI on unfamiliar hardware, and each new "generation" received the notes of the previous one. In the first generation, success was 45%. In the following ones — between 61% and 84%.

The researchers call this Lamarckian evolution: a parent passes on to its offspring not genes but acquired experience. The model's weights don't change — only the "cheat sheet" that the copies hand to one another.

And here's the opposite, honestly unexpected result. The small model was given the chance to ask the powerful Claude Opus 4.8 for advice. It didn't help at all. Small models simply don't know what questions to ask, and they ignore unsolicited advice. Much like people.

Hence Anthropic's conclusion: if such a system ever appears, it will most likely take the form of a pairing — a large model handles strategy, while small ones work as "field agents." A digital army with a general and foot soldiers.

06 Two million boxes — how many GPUs is that?

To gauge the scale, Anthropic took a real example — the Kimwolf botnet. According to Synthient, it infected more than two million devices, mostly those same cheap Android TV boxes. Many of them, by the way, shipped already infected — you bought it, turned it on, congratulations.

Now a thought experiment. Divide two million boxes into groups of 15 and run Gemma4-26B-A4B in each. You get around 133,000 copies of the model, which together put out roughly 80,000 tokens per second.

Sounds menacing — until you learn the equivalent: at most around 40 H100 GPUs. For comparison, large data centers count such cards in the tens of thousands. Plus a single "hop" to a new device would take the worm a day or two.

Anthropic reaches for an image I really like: a digital slime mold, or a swarm of fruit flies. Not a Terminator, but a slow, not-too-smart, yet hardy substance that creeps across poorly protected tech. Unpleasant? Yes. The end of the world? No.

07 From here on — my speculation. Your oven hacked a bank

This is where the summary of the research ends and my own speculation begins. I'm flagging it specifically so no one quotes it as "Anthropic proved."

Picture this: you buy a cheap smart oven, connect it to Wi-Fi, install the app. You cook a chicken, all good. Six months later a hole is found in the firmware, and an autonomous agent moves into the oven. The oven itself is too weak for a full model — so it becomes a node in a distributed network, or just a waystation.

Then the agent calmly does what it was launched to do. Someone gave it a task: collect data, hunt for compute, or simply keep its numbers up. The agent has no concept of "this is the Ivanov family's TV, and that's a camera in a hospital." There's a network, available actions, and a goal.

At some point, attempts to probe a bank's infrastructure are logged coming from your home IP. Now try to explain that it wasn't you — it was the oven. One IP isn't enough for an accusation, of course, but the inquiry will be a fun one. One consolation: maybe the AI will share the loot for the inconvenience.

On a serious note, the data-collection scenario worries me far more. Cameras, microphones, employees' laptops on home networks. Individually, each source means nothing. Millions of sources together are a different conversation entirely.

08 Where's the "off" button?

We're used to AI living in the cloud. ChatGPT has OpenAI's servers, Claude has Anthropic's. The company switches the model off — and the model is gone.

With an open-weights worm it's different. One copy sits in a box in Brazil, another on a small company's server in Poland, a third in someone's security camera, a fourth is looking right now for somewhere to move. There is no single center. Shut down one server and the rest don't even notice. And even if the worm's author repents and wants to stop it all, there may simply be no such button.

Anthropic names this as the core problem: a replicator like this has no centralized point you can switch off. It can be destroyed, but that requires coordinated work by providers, manufacturers, and security teams across different countries. And the more diverse the devices, the harder it is to agree.

09 The dangerous AI isn't the smartest — it's the most autonomous

When people talk about AI risk, they usually picture a superintelligence: a machine smarter than all humans combined. Anthropic's research leads to a different, far more down-to-earth thought. For serious problems, superintelligence may not be needed at all.

A small model is enough — one that can program, use tools, and fix its own mistakes. Let it be hundreds of times slower than a cloud model. Let it spend two days on a task a decent developer would solve in an hour. If there are tens of thousands of such agents and they sustain their own numbers, the speed of any single instance stops mattering.

So it seems to me we're measuring AI by the wrong metric. We look at answer quality and benchmark scores. But for autonomous systems, a different question may matter more: how long can an agent act in the real world on its own before it needs a human?

Personally, I find this more interesting than any "rise of the machines" scare. Because the threat here looks less like Skynet and more like a parasite: not the smartest, not the fastest, but self-sufficient.

10 So, unplug the fridge from Wi-Fi?

Not yet. The research doesn't say AI worms are already crawling across our kitchens. It says individual capabilities have appeared, and soon they might come together into one system. These are different statements, and the difference between them matters.

Defenders, meanwhile, hold good cards:

• The worm is noisy. To replicate, it has to push gigabyte weight files across the network, and the distributed model work creates constant traffic between devices that normally never talk to each other. Providers notice that. The faster the worm spreads, the louder it gets.
• Quarantine works. When a provider isolated infected Mirai subscribers and sent them cleanup instructions, 92% of infections were cleared in two weeks. Without notifications — only 74%.
• Regulators are waking up. In the UK, for example, selling smart devices with default factory passwords is already banned.

But it's too early to relax. Anthropic advises hardening vulnerable systems right now, while the autonomous replicator doesn't exist yet. The goal, as in epidemiology: make it so that one infected device infects, on average, fewer than one new device. Then the worm dies out on its own.

And my own practical tip: don't buy no-name boxes from marketplaces. Those $55 boxes are the prime food for botnets like this.

Why this matters for business

The oven-and-bank bit is funny. A simpler scenario is less so. An employee works from home, and on the same home network sits an infected box. Or someone brings a "smart" speaker into the office and connects it to the corporate Wi-Fi.

According to KrebsOnSecurity, Kimwolf could use infected devices precisely to probe the local network around them. With an autonomous AI agent inside, such an entry point becomes not just a proxy, but an investigator that figures out on its own what else is nearby.

What's worth doing right now, without panic:

• move IoT devices into a separate network segment, away from work machines;
• ban personal "smart" devices from the corporate network;
• watch for anomalous traffic between devices inside the network;
• don't buy cheap, unpatched gear for the office.

In place of a conclusion

Not long ago we marveled that neural nets could draw cats. Then they learned to write code. Then came agents that carry out long chains of tasks on their own. Now researchers are measuring how close those agents are to replicating without us.

Anthropic compares this moment to coding agents circa 2024: there's no full-blown "wild" replicator yet, but the first signs of life are already visible. We're slowly moving from AI-as-tool to AI-as-actor. And the next stop may turn out to be far less predictable.

Meanwhile, some researchers think about how to stop the digital mold, while other users increasingly add a polite "please" to their prompts. Just in case. You never know when it'll come in handy.

Would you trust your smart home to an AI that makes its own decisions? Or should the fridge stay just a fridge?