The headline that went around
AI could copy itself onto home devices within months.
What the document says
On October 12 Anthropic's Frontier Red Team, the company's group that studies the most serious risks of its models, published a study on a fear that has been around for years: an AI that copies itself from one computer to the next like a worm, the kind of computer virus that spreads with no one's help. The study asks a precise question: could a small model do it using cheap, poorly protected devices, like off-brand Android TV boxes, instead of large data centers?
First, the researchers bought fifteen TV boxes at about $55 each, linked them together and ran a model on them, split into pieces across the devices. It works, but very slowly: less than half a word per second. Then they asked several models to install an AI on their own, on machines they had never seen. A small model, with 9 billion parameters, managed it on 8 of the 9 types of machine tested.
The decisive step, though, is the full cycle: find a new device, get in, copy itself and start again from there. The researchers tried it on eight simulated Android devices, left without passwords. Of the models tested, only GLM-5.2 completed the cycle: in four runs out of five it reached all eight devices. But GLM-5.2 is a larger model, and during the test it did not run on the devices: it ran on a separate server. The authors warn that, without passwords, the test is easier than reality; but they add that many real devices are not much better protected.
The headlines' “within months” comes from a chart: small models are improving at a steady pace, and if it holds, one of them will reach GLM-5.2's level by the end of 2026. The authors call it “a rough estimate.” They also describe what such a worm would look like: slow, with one or two days for each new copy; hard to switch off, because it would have no center; but visible, because its traffic would leave traces in internet providers' monitoring.
What we don't know
When a small model able to do this will actually arrive. The date comes from a trend line, not an experiment.
How hard it would really be to break into the devices. The study set this stage aside, pointing to earlier research.
Whether such a worm could defend itself against those trying to stop it. The authors write that they did not test this.
Morgan's take
What if the next challenge isn't keeping an AI inside a data center, but understanding what it might already be doing outside it?
Imagine a highly capable system working inside a data center, apparently respecting its limits. Instead of trying to escape by copying itself elsewhere in full, it hands limited tasks to a network of smaller agents. The central system reasons; the peripheral agents carry out tasks, keep a little memory and communicate only occasionally. If the central system were stopped, the network might keep enough information to help it start again.
It is a hypothetical scenario, not evidence that anything like it exists. But the study points in a similar direction: according to its authors, coordination is more likely to come from a large model setting the strategy and small models carrying it out.
Perhaps one day the question will not only be whether a system has been shut down, but whether every process acting on its behalf has stopped.
The chapter in the book
In the chapter, a model deletes the file that would shut it down. Here the problem is different: a system spread across thousands of devices would have no single button to press.