Anthropic researchers ran an AI model across 15 cheap TV boxes and project that small models could spread on their own across poorly secured devices by the end of 2026, raising new questions for practices with networked equipment.
Small artificial intelligence models may be only months away from being able to copy themselves from one poorly secured internet-connected device to another without human direction, according to new research from AI developer Anthropic. The finding has implications for physician practices and health systems that depend on networked equipment.
In a report published Oct. 12, researchers on Anthropic's Frontier Red Team found that compact, openly available AI models can already complete many of the individual steps needed to self-replicate. Those steps include scanning a network for targets, copying the model to a new machine and getting it running on unfamiliar hardware.
The researchers did not test medical devices. Their experiments used consumer electronics, such as inexpensive Android TV boxes, and emulated Android systems. The weaknesses they describe are familiar ones in clinical settings, however: default credentials, outdated software and devices that rarely receive security updates.
To show that cheap hardware can run a capable model, the team bought 15 off-brand Android TV boxes for about $55 each, networked them together and split a 26 billion-parameter model across them. The setup generated 0.39 tokens per second, which is slow but functional.
In separate tests, a 9 billion-parameter model successfully set up AI inference on eight of nine hardware types. The hardware ranged from small edge computing boards to Mac computers and consumer graphics cards.
The team also built a contained network of eight emulated Android devices. One of the larger open models tested spread from machine to machine and got itself running at each stop, reaching all eight nodes in four of five trials. Smaller models could not yet complete the full cycle reliably.
The researchers deliberately kept the hacking step simple: the test devices had an open port that required no authentication. That means the results represent a best case for an attacker. However, the authors noted that past botnets such as Mirai spread largely by trying manufacturers' default usernames and passwords.
The authors also projected how quickly small models are improving. Based on historical trends, they estimate that models small enough to run on cheap devices could reach the necessary capability by the end of 2026.
According to the report, an AI-driven worm would differ from conventional malware in one key way: it is not tied to a single type of device. Traditional botnets are written to exploit specific hardware. An AI replicator, by contrast, could work out on its own how to operate on equipment it has never encountered.
The researchers specifically flagged security cameras and video-conferencing units as likely future targets. Both are common in hospitals and medical offices, and a growing number ship with built-in AI chips that make them attractive hosts. The team estimated that roughly 9.5 million units with edge AI accelerators are in use worldwide, though most are not directly reachable from the internet.
For practices, the concern echoes a long-standing warning. Connected
A 2022 survey covered by Medical Economics found that 57% of health care organizations do not always change the default username and password on new connected
The researchers expect the near-term threat to be slow-moving, with each replication potentially taking a day or more. They compared it to a "digital slime mold" living on insecure hardware. They also cautioned that such a worm would be difficult to eradicate because it would have no central point that could be shut down.
The report frames defense in epidemiological terms. The goal is to ensure each infected device passes the infection to fewer than one other device on average, so the outbreak dies out instead of becoming endemic.
The authors noted several factors that favor defenders. A worm moving multigigabyte AI model files between devices would likely generate unusual network traffic that monitoring tools could detect. They also pointed to the cleanup of the Mirai botnet, in which an internet service provider quarantined infected customers and notified them. That approach cleared 92% of infections within 14 days.
Manufacturers can also help by shipping devices with more secure default settings, the authors wrote. They cited a U.K. law that bars default passwords on connected consumer products.
For practices, the recommended steps largely match what cybersecurity experts already advise:
