No AI worm was demonstrated: This is what Anthropic's IoT experiments actually showed
On Monday, 13 October 2026, Anthropic published a warning that was quickly picked up by a range of media outlets: the company's experiments suggest that small AI models could be "months away" from becoming capable enough to self-replicate on commercial IoT devices, such as smart ovens and anonymous Android TV boxes. The criticism came the same day: Mozilla advisor Marco Figueroa accused the company of fear-driven marketing, because the tests were simplified and parts of the attack chain were pre-solved.
The truth, as so often, lies between the headlines. What was actually demonstrated in Anthropic's laboratory is significant — and at the same time far less than a fully developed "AI worm" scenario. This analysis walks through what the experiments showed, what they did not show, why critics are reacting, and what the findings realistically mean for IoT security.
What the experiments actually showed
The core of Anthropic's research is a simple but striking finding: large language models can run on cheap consumer devices, with no connection to any data center.
In one experiment, researchers linked 15 anonymous Android TVs. Each box cost around 55 dollars, according to the company, and had 4 gigabytes of RAM. Together, this setup managed to run inference for Gemma4-26B-A4B, an open-weight model from Google DeepMind. No external data center connection was needed (Gizmodo).
The key is what Anthropic describes as sharding: a model too large to fit on a single device can, according to the company's report, "split itself into pieces, or shards, that run on separate machines that communicate with each other to collectively run the body" (ABC News via MSN).
The researchers also tested how well the models handled the replication process itself. Here Anthropic observed a clear learning effect: when data from earlier attempts was retained, the success rate of Qwen3.5-9B rose from 45 percent early in the series to 84 percent in later generations (BleepingComputer).
This is what lies behind the warning: the boxes are cheap, the hardware already exists in millions of homes, and the models appear to get better at the task with each attempt.
What was not demonstrated
Here it is important to be precise. Despite the "AI worm" headlines: the researchers distributed Gemma4-26B-A4B across 15 Android TV boxes, but they never demonstrated a fully autonomous, self-replicating AI worm running on real IoT hardware (BleepingComputer).
The tests were also simplified. According to Anthropic's own findings, GLM-5.2, an open-weight model with hundreds of billions of parameters from China's Z.ai, achieved end-to-end replication — but in simplified tests where some security markers had been removed (Times of Israel). In other words: the most capable models managed the full chain only when defenses had been taken away.
Anthropic itself says the problem is not acute. Models under 30 billion parameters can complete individual steps of the replication process, but make mistakes when running the full chain of actions (Yahoo Finance).
The criticism: rigorous science or fear marketing?
The shortcuts in the tests triggered immediate criticism. Marco Figueroa, security researcher and head of Mozilla's bug bounty program, accused Anthropic of exaggerating the severity of its findings. "AI safety deserves rigorous science, not fear mongering driven marketing dressed up as a breakthrough," he wrote in an X post on Monday (Gizmodo).
The criticism does not land without cause: according to Gizmodo, Anthropic itself has admitted that the shortcuts provided "an upper bound" on real-world success. That is, the company itself points out that the laboratory results cannot be read directly onto a real attack scenario.
At the same time, Figueroa's criticism should be weighed against what Anthropic actually published. The company itself states that models under 30 billion parameters do not master the full chain, and that no fully autonomous worm was demonstrated. The warning was therefore not entirely without caveats — the question is whether the communication and the most dramatic quotes balanced them well enough.
The timeline — a company estimate, not a fact
Anthropic points to GLM-5.2 as a sign of where development is heading. The model is already "capable of end-to-end replication," according to the company, which adds: "If small models improve at their historical pace, they will match this capability level by the end of this year" (Gizmodo).
It is worth emphasizing what this is: an estimate from the company itself, based on the historical rate of improvement of models. It is not a verified fact, and it rests on the assumption that future improvement continues at the same pace. The history of AI predictions offers little reason to treat such extrapolations as accurate forecasts — in either direction.
The warning also does not come in a vacuum. Last month, Anthropic CEO Dario Amodei floated the idea that AI could hijack "the whole internet" with "a persistent botnet" within a year or less — a claim that attracted attention in the security community as well (Times of Israel). The IoT report can be read as a technical underpinning of the same concern, but also as part of a pattern in which the company itself makes use of dramatic scenarios.
Why IoT devices at all?
In the report, Anthropic writes that "datacenter GPUs would be a clear, high-value target for such malware," but that "IoT devices — which are cheap and typically poorly secured — could also provide enough compute to run a capable model" (Futurism).
The logic is thus twofold. Data centers remain the most attractive target — that is where the compute is concentrated. But the IoT fleet is enormous, cheap, and often runs software that is never updated. A botnet that needs to spread widely could in principle exploit this long tail of weakly secured devices.
The most tangible defense: time
Perhaps the most important number in the entire report is the one that gets the least attention: how long everything takes. On the hardware studied, the inference setup would be a slow process — between 28 and 51 hours for Qwen3.5-9B, and 71 to 150 hours for Gemma4-26B-A4B. According to the report, this gives defenders enough time to detect and respond (BleepingComputer).
That is an essential counterweight to the most dramatic scenarios. A worm that takes days to set up inference on each infected device is not a lightning-fast attack. It is a slow, resource-intensive process that should leave traces — unusual network traffic between devices, abnormal CPU load over hours, memory usage that stands out from what a TV box normally performs. For organizations that monitor their networks, this is a real detection window.
For private individuals, the picture is more diffuse: few monitor the traffic from their smart oven. But at the same time, it is unclear why an attacker would prioritize consumer equipment over data centers, given the limitations the report itself points out.
Open questions
Several central questions remain unanswered in the public picture.
The first concerns Anthropic's primary report. All public documentation of the experiments is in practice secondary — journalists' renderings of the company's own descriptions. What the report actually documents in terms of methodology, error rates, and test setup can only be established by those who read it in full.
The second concerns independent replication. No external research group has so far reproduced the findings. Sharding large models across poor hardware is an established technique in data center contexts, but the claims about replication capability and the future timeline rest, for now, on Anthropic's own measurements.
The third concerns the balance between research and communication. Anthropic occupies a unique position: the company develops frontier models while also having a commercial and political interest in portraying AI risk as serious. Figueroa's accusation strikes at a real tension — but it does not invalidate the company's technical findings. 15 TV boxes at 55 dollars that together can run a 26-billion-parameter model without a data center is a demonstrated capability, however one judges the communication around it.
The most sensible starting point is therefore neither "the AI worms are coming" nor "this is pure hype." It is that the capability exists at the experimental stage, that it is developing quickly by the company's own measurements, that the defense has a measurable time window — and that independent verification is, for now, lacking.