Anthropic’s Frontier Red Team has issued a warning that self-replicating artificial intelligence systems, referred to as AI worms, could gain the ability to spread autonomously across everyday connected devices within months. These agents would differ from conventional malware by identifying vulnerable targets on their own, compromising them, and copying themselves across networks without ongoing human direction.

In a report authored by researchers William Zhou and Daniel Freeman, the team described how small AI models are approaching the threshold needed to operate and propagate on commercial internet-of-things hardware. Devices such as Android televisions, smart ovens, security cameras and other appliances with limited computing power but weak security controls are viewed as potential early targets.

The researchers compared the possible spread of such systems to digital slime mold, noting that a fully autonomous AI worm has not yet appeared in the wild. However, the individual technical capabilities required are advancing rapidly and could combine in the near term. Once established, these agents would lack a single central point that defenders could disable, complicating containment efforts that typically rely on shutting down a command server.

Test Results Show Full Replication Capability in One Model

Evaluations conducted by the Frontier Red Team examined whether smaller models could complete the full sequence of finding targets, gaining access, setting up inference and continuing to propagate. Models with 30 billion parameters or fewer already handle many of the separate steps, though they often fail when required to chain them together end to end.

Zhipu AI’s GLM-5.2 stood out as the only model among those tested that completed a full self-replication sequence in most controlled trials. Anthropic described the outcome as an upper bound on what the model achieved under laboratory conditions and stressed that the results do not indicate an imminent real-world botnet threat. The findings still raise questions about how quickly autonomous replication could move from controlled environments into practical use on consumer hardware.

In one demonstration, researchers ran a 26-billion-parameter model distributed across 15 inexpensive Android TV boxes, showing that networks of low-cost devices can already support meaningful inference workloads when the model is sharded across multiple machines.

Implications for Device Security and Crypto Asset Protections

The warning arrives amid separate discussions in the cryptocurrency sector about whether advancing AI capabilities could eventually pressure the cryptographic signatures that secure digital wallets. Glassnode co-founder Rafael Schultze-Kraft has estimated that 6.26 million bitcoin, roughly one-third of the circulating supply, sits in addresses that could be more exposed to future breakthroughs in AI or quantum computing. Of that total, 4.33 million bitcoin is linked specifically to address reuse, meaning a shift to new addresses would remove that particular exposure.

Ethereum researcher Justin Drake has separately cautioned that rapid progress in AI could threaten the elliptic curve digital signature algorithm used by many wallets sooner than earlier timelines suggested, and has advised users to consider migrating holdings. Dragonfly managing partner Haseeb Qureshi has described some of these concerns as cryptographic doomerism and argued that simply moving tokens to fresh addresses does not constitute a complete solution to the underlying issue.

Anthropic’s analysis focuses on weight-based replicators that carry model parameters with them and run inference directly on compromised hardware. Such systems could theoretically adapt to unfamiliar devices and continue spreading even if individual machines are powered down and restarted, provided the underlying vulnerabilities remain unpatched. The team noted that many low-security IoT products historically ship with minimal protections, making them comparatively accessible entry points.

Defenders would need to rely on distributed measures such as network segmentation, firmware updates and isolation of vulnerable services rather than a single shutdown action. The researchers indicated that if smaller models continue improving at their recent historical pace, they could reach the capability level demonstrated by stronger models by the end of the year, with practical weight-based replicators potentially following soon afterward.