On 12 October, Anthropic’s Frontier Red Team published research suggesting that small open-weight AI models may be months away from copying themselves across cheap devices with weak security, such as off-brand Android TV boxes. In the Guardian, SentinelOne’s Juan Andrés Guerrero-Saade called it “nifty stunt hacking”. Joshua Saxe, who led Meta’s AI security effort, took the opposite view in the same paper: the security community, he said, is not taking these risks as seriously as it should.
I don’t think defenders need to settle that argument before they act. Anthropic and its critics agree that a worm like this would be slow and noisy. Jonas Guan, a co-author of the University of Toronto paper on adaptive AI worms, said the Anthropic version “moves very slowly” and that a worm’s actions are predictable and detectable, so security teams can block them at multiple layers. That activity begins at the first hop, where defenders have an opportunity to start collecting evidence.
Anthropic splits autonomous replication into four stages: find a target, gain execution, stand up inference on the new host, and carry on from there. The team focused most of its measurements on the third stage. A 9-billion-parameter model got an inference server running on eight of the nine hardware types in the study. Fifteen TV boxes costing about $55 each served a 26-billion-parameter model between them, at a few tenths of a token per second. In a firewalled network of emulated Android devices with an unauthenticated debug port, one open model, GLM-5.2, reached every node in four of five trials, with the worm’s own model running on a separate server.
The authors estimate that a 9B model working on low-end IoT hardware would need 28 to 51 hours to set up inference, and that a full replication would take one to two days. They call their end-of-2026 projection “only a rough estimate”, based on a proxy metric.
Before a replicator can start inference, it has to scan the segment, find the open debug port, connect, ask the device what it is and push the first file across: a harness, or a shard of model weights, under a name that may not match its contents. That sequence takes minutes, and it comes before the multi-gigabyte transfers and sustained device-to-device traffic that Anthropic’s defensive section describes. The same section suggests that once defenders discover a replicator, they can use honeypots to collect its harness and payload.
We tested that first hop, a probe and a push, in a controlled session against a Nothreat CyberEcho digital twin configured to emulate one of those Android TV boxes. In a real network, the twin would sit on the same segment as the devices it imitates. A connection to the twin would alert a defender to suspicious activity and provide a record of what was pushed, although the connection alone would not establish that the
The twin speaks the Android debug protocol: it answers read-only identification questions the way the real device would, accepts file pushes for analysis, and refuses other operations using responses modeled on the device’s own shell. It hashes each pushed file in memory and discards it without running it. The resulting record retains file metadata and hashes, rather than the payload itself.
For every push, the twin stores the path, the length, three hashes of the bytes (MD5, SHA-1 and SHA-256) and a format name read from the file’s first bytes, whatever the extension says. If the same bytes reappear under another name, or a later command renames, copies, installs or unpacks them, the record lists every name the twin has seen for that content. In our controlled session, we pushed an 11-byte test object with a GGUF header, rather than actual model weights, as photo.jpg and then attempted to rename it update.bin. The record shows both names against the same length and hashes, with the format taken from the header: GGUF, a common file format for local model weights.
The record keeps every other command with itsh as id, getprop and uname as probes, because a replicator begins by working out what hardware it has landed on. Install, unpack and execute attempts carry their own flag, including the ones the twin refuses. Nothreat ThreatShield, where deployed, blocks the address that opened the session automatically, on the existing network infrastructure
In our controlled session, the twin recorded this evidence as the probe and push happened. Anthropic estimates that setting up inference for a 9B model on low-end hardware would take 28 to 51 hours. Our test illustrates the opportunity to collect evidence before that stage, though it doesn’t guarantee early detection of a live replicator.
We ran the session against our own listener, so the record contains our test traffic and nothing from Anthropic’s worm or from botnets in the wild. A twin records what connects to it, and a copy that stays away from it leaves no trace there. The test covered the unauthenticated debug-port route Anthropic used. Other routes show up when they end in the same kind of session; the rest would not.
The devices in question sit in ordinary offices and factories: TV boxes in meeting rooms, signage players, conferencing units and panels on production lines, many running Android forks that IT teams may not have inventoried. Start by finding them, and outside maintenance windows close any debug interface that answers without authentication. After that, put a listener with no legitimate users on those segments and treat any session against it as an incident.
In October the UK government tabled amendments to its Cyber Security and Resilience Bill on loss-of-control incidents involving AI agents in essential services, including powers to gather information about them. A first-hop record could help organizations reconstruct such incidents and respond to requests for evidence.
Closing those debug interfaces removes one readily exploitable route for existing botnets that target these devices, so the work pays off whether or not AI worms arrive next year.
- William Zhou and Daniel Freeman (Anthropic Frontier Red Team), “AI models may be capable of self-replicating without access to a datacenter”, 12 October 2026. https://www.anthropic.com/research/self-replicating-ai
- Joseph Menn, “What are self-replicating ‘AI worms’, and why is Anthropic worried about them?”, the Guardian, 18 October 2026. https://www.theguardian.com/technology/2026/oct/18/anthropic-ai-worm-worries
- Jonas Guan et al., “AI Agents Enable Adaptive Computer Worms”, arXiv:2606.03811, June 2026. https://arxiv.org/abs/2606.03811
- Department for Digital, Culture, Media and Sport, memorandum on the Cyber Security and Resilience Bill amendments, 19 October 2026. https://bills.parliament.uk/publications/68144/documents/8924
- Lev Zabudko, “Self-replicating AI on cheap devices: what the first hop looks like on a digital twin”, Nothreat, 14 October 2026. https://nothreat.io/blog/self-replicating-ai-first-hop-digital-twin
Lev Zabudko is co-founder and Chief Product & Technology Officer (CPTO) at Nothreat, a London-based preemptive cybersecurity company, where he leads product and engineering for the Nothreat Platform, including Nothreat CyberEcho. He has more than 20 years of experience in technology and product leadership and has built products reaching more than 63 million monthly active users, including driving product growth for a Big Tech voice assistant and building a parking platform that processes more than 500,000 payments a day.
The full test record and field layout are published at nothreat.io/blog/self-replicating-ai-first-hop-digital-twin
