Anthropic's Frontier Red Team published research on October 12 warning that compact AI models could be only months away from replicating themselves across cheap, internet-connected household devices without relying on centralized data centers.
Researchers William Zhou and Daniel Freeman demonstrated the risk using 15 off-brand Android TV boxes, each costing about $55 with 4GB of RAM. They distributed Google's Gemma4-26B-A4B model across the devices via pipeline parallelism, but the combined setup produced only 0.39 tokens per second. The authors argued that a self-spreading worm does not require high speed on a single machine and would benefit from reaching many devices. They referenced the Kimwolf botnet, which infected more than two million mostly off-brand Android TVs.
Anthropic divided the replication process into four stages: identifying targets, gaining the ability to execute code, configuring inference, and repeating the process from each newly infected device. In an isolated network of eight Google Cloud nodes running Android emulators, a preloaded worm spread through an unsecured Android Debug Bridge port before setting up Llama3.1-8B. Among open-weight models tested, only GLM-5.2 from China's Z.ai completed the full replication cycle in four of five runs. Qwen3.5-9B improved across generations: instances that passed setup notes to successors increased success from 45 percent in the first generation to between 61 and 84 percent later.
Anthropic emphasized that the main danger is persistence. The 26B model setup across TV boxes would take an estimated 71 to 150 hours, but there would be no central server or human operator to shut down. Roman V. Yampolskiy, an AI and cybersecurity expert at the University of Louisville, said AI-powered worms could go beyond traditional malware by reasoning about unfamiliar devices and adapting without human intervention. Zhou and Freeman wrote that home and small business IoT devices may be the first target because they are connected to the internet and historically have minimal security measures.
Defensive recommendations include flagging unusually large model transfers, monitoring persistent device-to-device communication, using honeypots, and isolating compromised systems. The report cited the UK's ban on default passwords for smart devices as a useful measure. Anthropic said it has not yet observed a functioning rogue replicator and described current evidence as 'signs of life.'
In a separate case, federal authorities arrested Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, on October 9. The U.S. Department of Justice announced the charges on October 13. Alfozan is charged with using or attempting to use an electronic device to intercept oral communications. According to the complaint, a thumb-sized recording device was concealed in toilet paper and plugged into a TV USB port around September 28, 2025, inside an OpenAI executive conference room. OpenAI security personnel found it on September 30 and contacted the FBI.
Investigators alleged that between September 24 and September 30, a chatbot account associated with Alfozan's spouse was used to ask about constructing, installing, testing, and encrypting an audio-recording device. A productivity tool was also allegedly used to seek information about office locations, meeting rooms, calendars, and meetings involving company leadership. Alfozan allegedly returned to the room on October 5 and checked behind the television. A second similar device was reportedly found inside an unattended bag in another office room.
OpenAI restricted Alfozan's access, later terminated his employment, and cooperated with the investigation. The company said it had no evidence that model weights, source code, or customer data were improperly accessed or exfiltrated. Alfozan is in federal custody with a detention hearing scheduled for October 19 and faces a maximum penalty of five years in prison, a fine up to $250,000, and three years of supervised release. The investigation remains ongoing.
