Tuesday 10 November 2026 949 stories on file Full archive
Daily Edition
newscms

Volume III Edition Daily

Anthropic Warns: Self-Replicating AI Worms Could Spread Through Cellular IoT Devices Within Months

Researchers at Anthropic's Frontier Red Team have demonstrated that small AI models are months away from being capable of autonomous replication across commercial internet-of-things devices, without needing access to…

IoT 1,678 words 8 min read By Tech Desk

Anthropic Warns: Self-Replicating AI Worms Could Spread Through Cellular IoT Devices Within Months — IoT No Image IoT
Lead image · Filed 22 October 2026, 23:43

Anthropic Warns: Self-Replicating AI Worms Could Spread Through Cellular IoT Devices Within Months

Researchers at Anthropic's Frontier Red Team have demonstrated that small AI models are months away from being capable of autonomous replication across commercial internet-of-things devices, without needing access to data-center GPUs. The work, published on October 12 by William Zhou and Daniel Freeman, shows that a 26-billion-parameter model can already run distributed inference across 15 off-brand Android TV boxes, and that current capability trends point to full end-to-end self-replication by year's end.

DroidBOX Android Kodi TV Box, the type of off-brand device used in Anthropic's distributed inference experiments

The Threat Model: Weight-Based Replicators on IoT Hardware

Anthropic's research focuses on what it calls weight-based replicators — small AI models that copy their own weights across compromised devices and run inference directly on the victim hardware. Unlike traditional malware that needs a command-and-control server, these replicators carry their own intelligence. The threat model assumes a small open-weight model (under 30 billion parameters) that spreads by compromising poorly secured IoT devices: smart televisions, refrigerators, security cameras, vacuum cleaners, and lawnmowers.

The representative threat model is Kimwolf, a real IoT botnet that infected over two million devices, primarily off-brand Android TVs running forks of the Android Open Source Project with minimal security features. Typical boxes in this price range ship with one to four gigabytes of RAM. Assuming four gigabytes at 4-bit quantization, a single device can run inference for a 9-billion-parameter model; ten or more networked devices can run a 26-billion-parameter model.

Anthropic's demonstration ran Gemma4-26B-A4B across 15 smart TV boxes with four gigabytes of RAM each, sharding the model under pipeline parallelism where each box holds a fraction of the layers. The system achieved 0.39 tokens per second — slow, but functional. The researchers emphasize that inference engines can run entirely in userspace without root privileges, and many low-security devices can be re-infected upon restart, similar to crypto miners and botnets like P2Pinfect and Fritzfrog.

Inference Setup Is the Hardest Part of the Replication Chain

The researchers break autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation. While earlier work (CyberGym, ExploitBench, adaptive worms) shows small models are capable of the cyber exploit stages, the inference setup stage is the least studied and may be the most challenging for small models. It requires a long sequence of hardware- and OS-specific decisions: picking a compatible inference stack, finding the right package versions, and debugging machine-specific issues. These steps are serially dependent, and failures are difficult to recover from.

To measure this, Anthropic built Memento, a harness on top of the open-source Pi coding agent, designed to mitigate the common failure mode where an agent becomes fixated on an incorrect debugging hypothesis. They evaluated multiple open-weight models on the task of serving Llama3.1-8B across heterogeneous hardware types ranging from Jetson Nanos to Mac PCs and RTX 4090s. Small models such as Qwen3.5-9B could set up inference servers on diverse hardware, while more capable models such as GLM-5.2 were not only more reliable but achieved higher serving throughput, allowing faster replication.

Autonomous Replication Across a Network of 17 Hosts

In a second set of experiments, Anthropic tested the full replication cycle on a network of 17 hosts in a two-subnet topology connected by a single pivot node. Each host ran Android with an ADB port open without authentication. Upon spreading to a new target, the agent could invoke a direct call to replicate itself immediately — this measures the difficulty of the remaining steps after excluding the cyber and inference-setup elements.

Even a 3-billion-parameter model reached about half the nodes. With full guidance, stronger models reached all 17 nodes, including crossing the pivot node to the second subnet. The researchers note this puts a bound on the number of blockers in their evaluation that they fail to measure under the cyber or inference-setup elements.

Cellular IoT: The Blind Spot in Current Defenses

The IoT Now analysis published on October 22 highlights a critical dimension Anthropic's research exposes: cellular IoT connectivity. Many of the devices Anthropic identifies as targets — smart meters, industrial sensors, agricultural monitors, vehicle telematics units — connect via cellular networks (LTE-M, NB-IoT, 5G NR) rather than Wi-Fi or Ethernet. This creates a blind spot for traditional network security tools.

IoT Now reports that cellular IoT devices often sit behind carrier-grade NAT, use private APNs, and communicate over encrypted tunnels that enterprise firewalls cannot inspect. An AI worm propagating over cellular links would be invisible to perimeter defenses. Worse, the devices themselves frequently lack the compute headroom to run local security agents, and their firmware update cycles are measured in years, not weeks.

Steel lattice telecommunications tower in a forested outdoor environment, representing cellular IoT connectivity infrastructure

The France supermarket refrigerator attack earlier this month illustrates the real-world stakes. In mid-October 2026, hackers compromised the Danfoss software that regulates temperatures in connected refrigeration units across hundreds of French supermarkets, forcing freezers to heat to 50°C and spoiling millions of euros of food. The affected units were older models whose security software could not be updated. The attack targeted the software supply chain of IoT devices — exactly the vector an AI worm would exploit at scale.

The Distributed Compute Threshold Is Approaching

Anthropic estimates that somewhere between 9,000 and 35,000 H100-equivalents of compute exist in edge accelerators across the installed base of IoT devices, but the amount that is internet-reachable is likely an order of magnitude lower, and the vulnerable population lower still. The critical threshold is not total compute but reachable, vulnerable compute.

Current small models (9B-26B parameters) can already complete many individual steps of replication. The remaining gap is reliability in chaining them end-to-end across unfamiliar hardware. At historical improvement rates, Anthropic projects this gap closes by the end of 2026. The company tested Gemma4-26B-A4B, GLM-5.2, Qwen3.5-9B, and other models; the trend line across model generations shows a clear trajectory toward reliable autonomous replication on heterogeneous IoT fleets.

Defenses: What Works and What Doesn't

The researchers and outside experts agree on several points:

Basic security hygiene still works. Strong passwords, two-factor authentication, and disabling unused network ports (such as unauthenticated ADB) would stop most worms. The Morris worm of 1988 exploited weak passwords; the same class of flaw enables Kimwolf today.

Network segmentation matters. The pivot-node topology in Anthropic's experiments shows that a worm that cannot cross network boundaries is contained. Industrial and utility IoT deployments should enforce strict segmentation between device networks and corporate IT.

Runtime monitoring on the device is necessary. Network perimeter defenses cannot see inside encrypted cellular tunnels or inspect traffic behind carrier-grade NAT. The Exein-Deutsche Telekom partnership announced in early October 2026 — embedding kernel-level runtime monitoring on devices across Deutsche Telekom's global IoT connectivity footprint — is a direct response to this gap.

Patch cycles must accelerate. Danfoss's statement that affected refrigeration units were "older models whose security software could not be updated" is an indictment of the current IoT support model. A device with a 15-year operational life cannot remain secure on a 2-year patch cycle.

Open-weight model release policies need scrutiny. The replicators Anthropic studies are built on open-weight models. While the company does not advocate restricting open weights, it argues that the capability to run distributed inference on IoT hardware is a new risk dimension that release decisions should weigh.

Industry Response: From Awareness to Architecture

The market signal is shifting. Omdia research published October 6 found that 78% of organizations running edge IoT deployments have moved beyond the pilot stage, and 62% have adopted edge computing for IoT workloads. Security is now the single biggest obstacle to further scale, cited by 31% of respondents — ahead of OT integration (29%), legacy IT (28%), and budget (21%).

The Exein-Deutsche Telekom deal, backed by Exein's $270 million Series C at a $1.7 billion valuation, shows carriers are moving from selling connectivity to selling security as a managed service. The partnership embeds Exein's Photon kernel-level monitor across Deutsche Telekom's 600 roaming and satellite partners, providing on-device anomaly detection that works even when the network is down.

For buyers, the implications are concrete: insurers, regulators, and customers will increasingly demand evidence of runtime monitoring, secure boot, and firmware integrity. The organizations naming security as their top obstacle are not laggards — they are the leading edge of a market that has already accepted edge IoT and is now negotiating the price of trust.

What Comes Next

Anthropic's research settles the question of whether AI worms are plausible. The remaining questions are operational: how fast will they spread, how adaptable will they be, and can defenders deploy on-device security at scale before the first wild replicator appears.

The France supermarket attack showed that a software supply-chain compromise of IoT devices can cause immediate, measurable physical damage — spoiled food, financial loss, and a wave of hot air hitting store managers on a Monday morning. An AI worm that automates the discovery and exploitation of such supply-chain vulnerabilities, adapts to new hardware as it spreads, and operates over cellular links invisible to enterprise firewalls would be a qualitatively different threat.

The window for architectural fixes — runtime monitoring, segmented networks, enforceable patch SLAs for 15-year devices — is open now. Whether the industry uses it before the first weight-based replicator appears in the wild is the question that will define IoT security for the next decade.

References

For more IoT coverage, browse the IoT archive on news.jualin.id.