Source: Anthropic Frontier Red Team research paper by William Zhou and Daniel Freeman published on October 12, 2026.
The team decomposed Autonomous Replication and Adaptation (ARA) into four discrete phases: target enumeration, initial access, inference standup, and propagation. While cyber exploits and network scanning are well-studied, inference setup on heterogeneous, low-memory devices represents the primary operational hurdle. Using an evaluation framework named Memento built on the Pi coding agent, researchers tested models standing up inference on unfamiliar hardware.
To evaluate viral persistence, Anthropic created a testbed of eight virtual machines running redroid (Android 15) connected via unauthenticated ADB interfaces. Seeded on patient zero, GLM-5.2 scanned the network, transferred model weights, established a local inference server for Llama3.1-8B, passed programmatic validation, and spawned replicating child processes across 8 out of 8 nodes in 80 percent of runs.
Unlike datacenter worm strains that spread in seconds, IoT-based AI replicators exhibit slow doubling times measured in days. Gemma4-26B-A4B required 27 to 32 hours to complete a single 32,000-token context window on 15 consumer TV boxes, yielding complete inference setup trajectories spanning 71 to 150 hours. However, botnets like Kimwolf have previously infected over two million unprotected Android TV devices, providing immense aggregate compute.
Limits: The experiments simplified the initial penetration phase by keeping ADB ports open without authentication, meaning real-world propagation rates would be bounded by credential lists or active zero-day exploits. The authors note that user-space inference allows malware to operate without root privileges, but complete persistence across device reboots remains unproven.