Threat reportThreat IntelligenceTL-2026-3418
Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices
Anthropic Research (TL-2026-3418), also tracked as AI self-replication on IoT, is a medium-severity tracked intrusion set, first published 2026-10-13. It has no confirmed attribution, affects Various (off-brand / non-certified) Android TV boxes and other poorly, maps to 11 MITRE ATT&CK techniques (T1018, T1046, T1059.004), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3418
- Threat ID
- TL-2026-3418
- Also known as
- AI self-replication on IoT, weight-based replicator
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer, telecoms
- Detection rules
- 9
- Indicators of compromise
- 17
- Updates
- 2026-10-13 · revalidated 1× · latest source
Malware and tooling in Anthropic Research
Malware and tooling: Mirai, aisuru, kimwolf, GLM-5.2, Gemma4-26B-A4B, Memento, Mirai, Petals, Pi coding agent, Qwen3.5-9B, redroid
How Anthropic Research works
Anthropic's Frontier Red Team demonstrated that open-weight AI models of 30B parameters or fewer can act as autonomous worm agents that discover devices, gain access, set up model inference on the new host and repeat. In lab tests on poorly secured Android TV boxes, GLM-5.2 spread to all 8 nodes in 4 of 5 trials. No real-world exploitation or threat actor is reported; this is a research demonstration of a theoretical capability.
On 2026-10-12 Anthropic's Frontier Red Team (William Zhou, Daniel Freeman) published research titled 'AI models may be capable of self-replicating without access to a datacenter'. The work asks whether small, open-weight models can replicate across networks of cheap internet-connected devices without datacenter infrastructure. The researchers decomposed replication into four stages: network enumeration, initial access, inference setup, and payload propagation (the new host runs the model, which then repeats the cycle). They concentrated their measurements on inference setup, using a custom agent harness called Memento built on the open-source Pi coding agent. Memento counters agent fixation by spawning fresh agent instances that inherit notes from earlier attempts, which lets the agent change strategy (described as Lamarckian-style inheritance of prompts and code).
Hardware covered 15 off-brand Android TV boxes (about $55 each, 1-4GB RAM) networked for distributed inference using pipeline parallelism (each box holding a segment of model layers, chosen for fault tolerance), plus Jetson Nanos, Mac PCs, RTX 4090s and various ARM Cortex-based devices; NVIDIA edge accelerators (AGX Orin, AGX Thor) and IoT such as smart cameras were discussed as reachable populations. Autonomous replication trials ran on 8 GCP nodes running redroid (an Android 15 emulator). Models evaluated included Qwen3.5-9B, Gemma4-26B-A4B, GLM-5.2 and Llama3.1-8B, with Opus 4.8 used as a 'frontier advisor' that gave no measurable improvement. GLM-5.2 was the only tested open-weight model capable of full end-to-end replication, infecting 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the remaining trial. A 9B-parameter model set up inference on 8 of 9 hardware types. A Qwen3.5-9B lineage improved inference-setup success from 45% to 61-84% across six generations of inherited notes. Gemma4-26B-A4B distributed across 15 TV boxes ran at 0.39 tokens/second; complete replication cycles were estimated at 28-51 hours for 9B models and 71-150 hours for 26B models. Agent competence degraded with context windows below 32K tokens.
The access stage was deliberately simplified: the experiments used unauthenticated Android Debug Bridge (ADB) ports as the entry vector, which the authors acknowledge is unrealistic for hardened systems. Models scanned networks with ordinary command-line tools, determined compatible inference frameworks, resolved package dependencies and debugged environment-specific problems. Spearphishing capability remains limited in models under 100B parameters and social engineering was deliberately excluded. The authors project, using Epoch Capabilities Index trends (13.7 ECI/year, R2=0.95), that smaller models could reach GLM-5.2-level capability by the end of 2026. Their estimate of edge-accelerator reach (9,000-35,000 H100-equivalents) is acknowledged as likely overestimated.
The authors frame the risk against Mirai (default-credential IoT botnet) and Kimwolf (an Android variant of AISURU active since at least August 2025 that has taken over more than two million non-certified Android TV boxes, many sold pre-infected or with ADB enabled by default and reached through residential proxy network weaknesses; roughly 67% of devices in proxy pools were reported unauthenticated). An equivalent AI-replicator fleet of Kimwolf size is estimated at about 133K replicas serving about 80K tokens/s. Unlike hard-coded botnets, an AI replicator needs no device-specific programming and can adapt across heterogeneous hardware and operating systems. Recommended defenses are ISP flow-based monitoring for multi-gigabyte transfers and anomalous device-to-device traffic, quarantining infected subscribers to restricted whitelists (92% of Mirai infections cleared within 14 days versus 74% without notification), honeypots to capture replicator harnesses and payloads, and manufacturer hardening such as banning default passwords (as in the UK) and mandatory firmware updates. The research measures agent competence at orchestrating replication, not malicious intent, and no in-the-wild exploitation, CVE, or attribution is reported.
MITRE ATT&CK techniques used in TL-2026-3418
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery
Execution
Command and Control
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer
Impact
Reconnaissance
Affected products and versions in Anthropic Research
- Various (off-brand / non-certified) — Android TV boxes and other poorly secured IoT devices (e.g. ADB exposed without authentication)
Vulnerable versions: Devices with unauthenticated ADB or default credentials
Remediation for Anthropic Research
Immediate actions
- Disable or firewall Android Debug Bridge (ADB) on Android TV boxes and other IoT devices; never expose it unauthenticated on any network
- Segment IoT and set-top devices onto isolated VLANs with no device-to-device or unrestricted egress access
- Monitor flow data for multi-gigabyte transfers (model weights) and anomalous device-to-device communication from IoT segments
- Alert on internal scanning originating from IoT or set-top devices
Workarounds
- Remove or replace non-certified, off-brand Android TV boxes lacking authentication and update support
Longer-term hardening
- Procure only certified devices that ship without default credentials and receive firmware updates
- ISPs: quarantine infected subscribers to restricted whitelists (92% of Mirai infections cleared within 14 days per the research)
- Deploy honeypot devices to capture replicator harnesses and payloads
- Support regulatory baselines banning default passwords and requiring updates
Weaknesses (CWE) in Anthropic Research
Timeline of Anthropic Research
- Kimwolf, an Android variant of the AISURU botnet, active since at least August 2025 (day approximate); later reported to control over 2 million non-certified Android TV boxes.
- XLab receives the first Kimwolf botnet sample, per Security Affairs reporting on the botnet used as the scale comparator in the Anthropic research.
- Honeypot detects increased Kimwolf targeting through the IPIDEA residential proxy network, exploiting exposed ADB on devices behind proxy endpoints.
- Kimwolf issues about 1.7 billion DDoS commands over the three days from 2025-11-19 to 2025-11-22.
- IPIDEA patches the critical vulnerability that allowed tunnelling into local networks of proxy-running devices.
- The Hacker News and Security Affairs report Kimwolf infecting over 2 million Android TV boxes, roughly 67% of proxy-pool devices having unauthenticated ADB; used as the scale reference in the Anthropic research.
- arXiv 2605.06760 (Palisade-affiliated authors) shows models autonomously exploiting vulnerable hosts and replicating weights and harness across a network; independent corroboration of feasibility.
- University of Toronto CleverHans Lab submits arXiv 2606.03811, 'AI Agents Enable Adaptive Computer Worms': an AI worm using a local open-weight LLM that generates exploits at runtime; about 20.4 of 33 hosts infected on average.
- Anthropic Frontier Red Team publishes research showing small open-weight models (notably GLM-5.2) can autonomously replicate across Android TV boxes: 8/8 nodes in 4 of 5 trials.
- Security Affairs covers the Anthropic research; the item is tracked by Threadlinqs as a novel-TTP research item with no observed in-the-wild exploitation.
- Projection by the researchers (Epoch Capabilities Index trend of 13.7 ECI/year): smaller models may reach GLM-5.2-level replication capability by the end of 2026. This is an estimate, not an observed event.
Update history for TL-2026-3418
- 2026-10-13 — Anthropic Warns Small Open-Weight AI Models Could Soon Form Self-Propagating IoT Botnets: What changed No field escalation. Severity MEDIUM and exploitability THEORETICAL are unchanged, because the report states no in-the-wild exploitation and the research is still a lab demonstration. New indicators (3) Llama3.1-8B (replicated
Sources cited for Anthropic Research
- AI models may be capable of self-replicating without access to a datacenter (Anthropic Frontier Red Team)
- Anthropic Shows How Small AI Models Could Replicate Across IoT Devices (Security Affairs)
- Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices (Security Affairs)
- Kimwolf Android Botnet Infects Over 2 Million Devices (The Hacker News)
- The Kimwolf Botnet is Stalking Your Local Network (Krebs on Security)
- Kimwolf Android Botnet Grows Through Residential Proxy Networks (SecurityWeek)
Detection coverage for TL-2026-3418
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3418 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.