Security Leaders Weigh In

John Gallagher, Vice President at Viakoo:

For a long time OT/IoT devices have been a preferred target for botnets due to lack of effective automated cyber hygiene being used on them. The Mirai botnet in 2016 primarily used video recorders and related devices to launch massive attacks from, and more recently botnets like KimWolf. This is different — traditional botnets are static scripts. Anthropic’s experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails.

This can be considered a breakthrough because it leverages the ability of frontier AI to work and adapt to multiple operating systems.  There are over 150,000 unique operating systems with OT/IoT devices, and without AI that would otherwise be a barrier to the reach of bots placed on OT/IoT devices. 

Anthropic’s timeline for practical AI self-replication seems highly realistic for local/edge propagation within 12–24 months but is overstated if viewed as a sudden global “digital slime mold.”  While today’s OT/IoT devices contain significantly more compute power and storage than older systems (think devices with NPUs and custom memory), there are other barriers to achieving practical AI self-replication.  For example, moving gigabytes of model weights over cellular/low-bandwidth OT/IoT connections or onto memory-constrained flash storage remains a massive practical hurdle.  

Automating OT/IoT device cyber hygiene is non-negotiable. Defenders cannot rely on “device obscurity” or low compute specs to protect edge assets. Every OT/IoT device must have automated firmware patch enforcement, active certificate management, and automated password rotation to eliminate initial access entirely.

This destroys the myth that cyber criminals need to harness powerful or IT-based compute capabilities. Defenders historically assumed that sophisticated AI models require expensive datacenter GPUs, meaning an AI-driven attack would need to touch AWS, Azure, or private clusters where detection tools (EDR/XDR) are mature. Anthropic proved that 15 cheap TV boxes without proper cyber hygiene networked together can execute distributed inference.

Collin Hogue-Spears, Senior Director of Solution Management at Black Duck:

A scripted worm runs only where its authors compiled it. In Anthropic’s October 12 test, Alibaba’s Qwen3.5-9B configured unfamiliar hardware itself and set up a model server on eight of nine hardware types. That test held the door open on purpose and measured what a model does once inside. Anthropic tested models under orders to replicate, not models choosing to. The propagation test ran on emulated devices, and the model steering the worm, Zhipu AI’s GLM-5.2, ran on a separate server because the emulated devices were too small to hold it. Anthropic says it has no full worm yet, and its end-of-2026 projection rests on what the report calls a proxy metric.

The AI worm Anthropic describes spreads in four steps: find a device, break in, set up a model there, and repeat from the new host. Mirai carried a password list. An AI worm carries a model, and its new work starts after the break-in: installing an inference engine, the software that runs a model, on the device it just entered. Cheap devices hold only small models, so Anthropic’s scenario centers on open-weight models of 30 billion parameters or fewer, files anyone can download and run. Today those models complete individual steps and fail at the full sequence. A 4-gigabyte TV box cannot hold Google’s 26-billion-parameter Gemma 4 on its own. Fifteen boxes pooled their memory to run the model at 0.39 tokens per second in Anthropic's test. No worm spread between those boxes; the run measured inference alone. Anthropic’s candidate first targets are home and small-business devices: Android TV boxes, plus security cameras and video-conferencing units whose new AI chips offer a worm extra computing power.

A working AI worm would turn a company’s unmanaged devices into attack hosts, and the defenses are the ones that already contain scripted botnets. By Anthropic’s estimate, 2 million hijacked TV boxes add up to at most about 40 Nvidia H100 data-center GPUs. The risk is persistence, not horsepower. On Anthropic’s numbers, an AI worm on cheap hardware doubles in days. A device that restarts clean stays exposed until someone closes the port the worm came through. The cost to a business is cleanup: isolating, then fixing or replacing, devices that often have no patch to apply. That work starts at branch offices and other sites with thin security staffing. Conventional bots are small files. A worm carrying its own AI model moves gigabytes to spread, and a model running across several devices keeps those devices exchanging traffic. Anthropic itself names those multi-gigabyte transfers and the sustained device-to-device traffic as the signals to watch.

Strategic Takeaway:

Security leaders must start with the devices that cannot run an endpoint agent, from conference-room displays to cameras. Give each one a written list of permitted connections and deny the rest; NIST's Manufacturer Usage Description guidance, SP 1800-15, shows how. An AI worm adapts to the device it reaches. Segmentation limits which devices an AI worm reaches.

Inventory every Android-based appliance (displays, TV boxes, kiosks and video-conferencing units) and find any debugging service that answers over the network, starting with Android Debug Bridge on TCP port 5555. Disable each one outside maintenance windows. Anthropic's test worm paired new AI with Kimwolf's old way in an open Android debug port.

Then alert when a device with no endpoint agent pulls a gigabyte-scale transfer from a peer device or an unapproved host or holds sustained traffic with another such device. Pre-approve the response path: investigate, quarantine when the traffic has no business explanation, then reimage or replace devices with no vendor fix. Leave devices without an endpoint agent on a flat network with a debug port answering, and you hand any self-spreading worm its path from one device to the next. If you hunt for AI-written code instead of watching that traffic, you will miss the model weights crossing your own network. Two conference-room displays trading gigabytes need an investigator, not an AI detector.