Anthropic: Small AI Models Could Enable Self-Replicating Worms by Early 2027

Anthropic has warned that progress in small AI models could, as early as the beginning of next year, create conditions for the near-uncontrolled spread of AI worms. The term refers to programs that replicate on their own and jump to new devices without human involvement. The company estimates that stopping such a spread would be extremely difficult. Servers, TVs and household appliances are named among the potential targets. The horizon in question is measured in months, not years.

Why small models in particular are cause for alarm

A classic worm exploits a vulnerability that is already known. Its author has to know in advance what to break, and has to write new code for each new platform. An AI worm, if we follow the logic of Anthropic's warning, can adapt on the spot: study an unfamiliar device, pick a way in, and move on.

Large models are a poor fit for this job. They need powerful GPUs, a lot of memory and, as a rule, calls to a cloud API, which the provider can track and shut off. A compact model works differently. It fits on modest hardware, runs locally and leaves no traces in someone else's infrastructure. That is why progress in model miniaturization is both a technical achievement and a risk factor at the same time.

What is known and what is not

The public account of the warning offers few details. Below is what can be stated based on the available information:

• Who issued the warning: Anthropic, developer of the Claude family of models.
• Timeframe: conditions for mass spread could emerge by the beginning of next year.
• Mechanism: autonomous replication and infection of new types of devices without human involvement.
• Potential targets: servers, TVs, household appliances.
• Assessment of defenses: blocking the spread would be extremely difficult.
• Not disclosed: specific models, parameter counts, the evaluation methodology, and the probability of the scenario.

It is not yet known whether the forecast rests on lab experiments, threat analysis or simulation. Without a technical report, it is hard to tell a real risk assessment from excessive caution.

This has happened before, only at a different scale

The idea is not new. In 1988, the Morris worm knocked out roughly six thousand machines on a still tiny internet and showed how quickly self-propagating code can slip out of control. In 2024, Cornell Tech researchers demonstrated Morris II: a worm for generative AI ecosystems that, in lab conditions, spread through email assistants built on language models using self-replicating prompts. It was an experiment in a controlled environment, but it confirmed the principle.

A separate problem is that the pool of connected devices has grown by orders of magnitude since then. TVs, refrigerators and routers are rarely updated and almost never monitored. For a worm that can think on site, that is a convenient environment.

What to do right now

Server administrators and infrastructure owners should take care of basic hygiene, which pays off whether or not the forecast comes true:

• Inventory all connected devices, including "smart" equipment in offices.
• Move IoT devices onto separate network segments and block their access to internal servers.
• Disable unused services and remote interfaces, and change factory-default passwords.
• Turn on outbound traffic monitoring: an infected device gives itself away through anomalous connections.
• Limit the permissions of AI agents: no code execution and no email access without human confirmation.

Developers of AI agents would do well to remember the lessons of Morris II: any text an agent reads is potentially a command. Now we have to wait for Anthropic's technical report. It will determine whether the warning becomes a working threat model for the industry or remains a thesis without evidence behind it.