On October 12, 2026, Anthropic's Frontier Red Team published research with an uncomfortable conclusion: small models of 9B to 30B parameters could be months away from copying themselves across cheap IoT devices, without relying on any data center. What matters is separating what they measured from what they project.
A classic worm copies itself from machine to machine without human intervention. An AI worm would do the same, with one key difference: it would carry the model weights with it and run inference directly on the compromised device. The weights become part of the malware. According to Anthropic, that means the replicators would operate independently of cloud resources, so there would be no central point defenders could shut down, and they could also adapt to devices they don't know, something conventional malware doesn't do.
Anthropic tested models between 9B and 30B parameters. A 9B model was able to run inference on 8 of the 9 hardware types evaluated, and models of up to 30B managed to complete individual replication tasks. The strongest variants, such as GLM-5.2, showed full end-to-end replication, but only in simplified, controlled evaluations.
The tests used simplified cybersecurity environments with no authentication barriers. Compromising real devices is harder. Propagation would be slow (days per replication cycle), and current models of this size lack sophisticated social engineering capability. The end-of-2026 date is a projection based on the improvement trend of small models, not a capability observed today.
There is a precedent that adds context: in June 2026, University of Toronto researchers, according to The Register, demonstrated a worm driven by a 2025 open-weight LLM that exploited already known vulnerabilities (not zero-days). On a 33-machine test network it replicated to about 62% and took roughly five days to reach half the network. It's slow and not very stealthy, but it works without anyone else's infrastructure.
Anthropic recommends monitoring for multi-gigabyte transfers on the network (moving model weights leaves an enormous traffic footprint), ISP-level quarantine for infected subscribers, manufacturers meeting secure-by-default standards, and coordinated remediation among providers.
Takeaway for your company: the immediate risk isn't that an AI worm attacks you tomorrow, but that your inventory of cheap IoT devices (cameras, TV boxes, sensors, printers) with default credentials becomes more dangerous: each one would be a potential compute host. Three concrete actions: segment IoT onto an isolated network with no free access to the internet, alert on multi-gigabyte inbound or outbound transfers from devices that normally move kilobytes, and require hardware vendors to provide patches and unique credentials per device.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel