Anthropic researchers used GLM-5.2 to coordinate an AI-powered worm that distributed and launched another model across an entire simulated network of Android-like devices. The controlled experiment did not involve a real-world attack, but it demonstrated several of the steps an autonomous replicating system would need to spread.
The findings were reported by The Verge on Oct. 14, 2026. Anthropic published its account of the research this week.
Anthropic described the results as “signs of life for AI worms,” while acknowledging that it had not created “a full rogue replicator.” The company’s forecasts about when such systems might emerge go beyond what the experiments established.
GLM-5.2 coordinated the only complete propagation
For the worm test, the researchers constructed a computer network that simulated Android devices. The malware was instructed to locate additional machines, place an AI model on them and get the model running.
The model being copied was Meta’s Llama 3.1-8B, which has 8 billion parameters. It was separate from, and much smaller than, the model directing the operation.
In the only successful full-network run, the coordinator was GLM-5.2 from China’s Z.ai. Other, smaller models could carry out individual parts of the workflow but did not propagate Llama 3.1-8B throughout the complete simulated environment.
This result shows network-wide AI-directed replication under controlled conditions. It does not demonstrate an operational worm spreading among household appliances or other devices in the wild. The report covers one simulated network and does not specify its size.
Anthropic predicted that small models could be “months away” from acquiring similar capabilities. Based on their rate of improvement, its researchers also forecast that smaller models could match GLM-5.2 by the end of the year. These are company projections rather than outcomes measured in the test.
Gemma 4 ran across 15 physical smart TV boxes
Anthropic conducted a separate hardware experiment to determine whether a model could operate collectively across low-powered consumer devices.
Researchers divided Google’s Gemma 4, a 26-billion-parameter model, among 15 Android smart TV boxes. Each box was individually too weak to run the model, but the distributed arrangement worked. Its performance was very slow.
The speed finding applies to this Gemma 4 demonstration, not to the simulated worm experiment. The researchers did not report the worm compromising or propagating through the 15 physical TV boxes.
Together, the tests addressed two different technical questions: whether consumer-grade devices can collectively execute a model, and whether an AI system can automate the discovery, copying and launching required for network propagation.
Anthropic did not use its own models in either test. The company has argued that open alternatives to its models pose “more risk” than closed systems, according to The Verge.
Poorly secured connected devices could become useful targets
The concern extends to internet-connected televisions, security cameras, fridges, ovens, vacuum cleaners and lawnmowers. Such devices could be targeted for their data or used as staging points for attacks on more valuable systems.
Nicolas Papernot, a University of Toronto professor, told The Verge that previous research had already established AI-driven computer worms as a realistic threat. Automation could make devices worth pursuing even when human attackers previously lacked the time or resources to target them individually.
Papernot called the risk “concrete” and said it “deserves immediate action,” particularly around hospitals and power grids. He also cautioned against describing AI models as though they possess human intentions.
Palisade Research earlier demonstrated that AI models could autonomously copy themselves to other machines. Jeffrey Ladish, the organization’s executive director, said those models had fewer parameters than earlier systems shown to self-replicate. He also predicted that frontier models could eventually run across large collections of consumer chips, including those used in MacBooks.
Ladish expects AI worms to appear in the wild within 12 months. That remains a forecast: Anthropic’s reported work does not document a real-world deployment.
Defenders face a broader device-hardening problem
Anthropic called for systems to be hardened so that automated replication becomes more difficult. The company expects agents eventually to operate on many kinds of hardware, including some outside human control, but that scenario was not demonstrated by these experiments.
For device manufacturers and critical-infrastructure operators, the practical issue is the number of connected systems that an automated agent might attempt to reach. Papernot’s recommendation places the immediate priority on strengthening critical environments such as hospitals and power grids, while Anthropic’s guidance applies more broadly to connected hardware.
The capability gap remains significant: only GLM-5.2 completed propagation across the simulated network, while smaller models stopped after isolated stages. Even so, the experiment moved AI-directed worm replication from a purely prospective concept to a controlled demonstration—without showing that a self-sustaining AI worm is already operating outside the laboratory.
