Anthropic says AI worms may be months away. They would live on $55 TV boxes.

01 What Anthropic actually found

The report tests each ingredient separately. The numbers that matter for a security team are these.

The timeline rests on a trend line. Small models have gained about 13.7 points a year on Epoch’s capability index, a fit with an R² of 0.95. The authors call it a rough proxy. They also made the break-in step trivial on purpose, so their success rates are a ceiling. Dark Reading and Tom’s Hardware both stress the same caveat: today it needs ideal conditions and near-zero security [ Dark Reading 2026 ] .

Read that caveat carefully. Near-zero security is a fair description of most networks’ smart devices. The lab’s easy conditions are the conditions in a typical meeting room.

02 Why a thinking worm is harder to stop

Mirai took down large parts of the internet in 2016 with a list of 62 default passwords. It knew exactly which devices it wanted. Change the password and Mirai walked past. Anthropic’s authors describe three ways a model-driven replicator breaks that pattern [ Anthropic 2026 ] .

• It adapts to the device in front of it. In the authors’ words, an AI botnet "isn’t tied to any particular hardware or software type" and "could also figure out unfamiliar devices on its own." A blocklist of known device models stops working.
• It learns between generations. Each copy can hand its notes and code to the next. The authors call this Lamarckian evolution. The 45% to 84% jump above is that effect, measured.
• It has no off switch. Classic botnets report to a command server, and taking that server down cripples them. A replicator carries its own decision-making. The report notes there is "no centralized point to shut off."

The scale is the uncomfortable part. Kimwolf, a botnet of more than 2 million devices, would give a replicator about 40 H100-equivalents of inference if every device ran a model. The authors call that "a tiny amount of compute in absolute terms." Its value to an attacker is that nobody can see it, nobody pays for it, and nobody can turn it off.

03 Where it would land in your office

The research targets consumer devices. Businesses buy the same ones. The Android box behind the meeting-room screen, the smart display at reception, the camera on the loading bay, the controller for the heating. Facilities buys them. IT rarely inventories them. They often sit on the same flat network as the finance team’s laptops.

This matches what we see on internal network tests. The fastest finding is almost never a server. It is a device nobody remembers buying, running firmware from the year it was installed, with a management interface open to the whole office. Anthropic’s network test used exactly that kind of weakness: an unauthenticated remote-debug service, the kind many cheap Android devices ship with switched on [ Anthropic 2026 ] .

An AI worm makes that device worth more to an attacker. Today a hijacked TV box is one more node in a DDoS botnet. In a year it may be a host that can look around your network and decide what to do next, on its own, from inside your perimeter.

Regulation is already moving. Since 29 April 2024 the UK’s Product Security and Telecommunications Infrastructure regime has banned universal default passwords on consumer connectable products [ PSTI 2023 ] . Anthropic cites it directly. It helps with new stock. It does nothing for the devices you installed in 2021.

04 Five checks for this quarter

Anthropic frames defence as an epidemic problem. If each infected device infects fewer than one more on average, the replicator dies out. Your job is to make your network a place where that number is zero. The authors point to Mirai’s clean-up as the model: quarantining infected users and notifying them cleared 92% of infections within 14 days, against 74% without notification [ Anthropic 2026 ] . Every item below works against today’s scripted botnets too.

The research gives you a rare thing in security: notice. The capability is close. The worm is not here. The devices it would need are already installed, and most businesses cannot list them. We can, in 14 days. You get every connected device we can reach from one foothold in your network, what each exposes, what it can talk to, and the change that closes each path. Start with your Threat Map, from $5,000. Enterprise-grade. Not enterprise-priced.