News/October 18, 2026

Fact check: Anthropic's AI worm ran on 15 TV boxes, not through real TVs

A Guardian report by Joseph Menn on October 18, 2026 says Anthropic's red team built a malicious AI program that spread on its own through smart TVs and split itself across 15 of them.

·4 min read·AB

Diagram of Anthropic's two tests: 15 TV boxes running one split model, and 8 simulated machines in a closed cloud network
Image: Apply Coding (illustration)

A Guardian report by Joseph Menn on October 18, 2026 says Anthropic's red team built a malicious AI program that spread on its own through smart TVs and split itself across 15 of them. We checked it against Anthropic's own October 12 research post. The core research is real, but that framing goes further than the experiments did.

Anthropic researchers William Zhou and Daniel Freeman bought 15 off-brand Android TV boxes, about $55 each, networked them, and ran the Gemma4-26B-A4B model split across all 15 at 0.39 tokens per second. That shows cheap, poorly secured devices can pool enough memory to run a capable model. It was not a worm moving through televisions. The replication test ran separately on 8 emulated Android nodes in a firewalled Google Cloud network, with an open, unauthenticated ADB port standing in for the hacking step, and the worm's own model ran on a separate server. Only GLM-5.2 finished the full cycle, reaching all 8 nodes in 4 of 5 trials.

Anthropic expects small models to reach that level by the end of 2026, and estimates such a worm would be slow, doubling over days. A University of Toronto paper from June already showed an AI-driven worm spreading inside an isolated 33-host test network. Some experts quoted by the Guardian called the threat overhyped and said basic security hygiene still stops most worms.

Why it matters

The tools that make AI agents useful, code execution and network access, are the same ones a worm needs, so agent permissions and exposed devices are real attack surface now.

Source: The Guardian

What checks out and what does not

  • Anthropic published self-replication research this month. True. The post, by William Zhou and Daniel Freeman of Anthropic's Frontier Red Team, went up on October 12, 2026.
  • A worm "spread autonomously through" 15 smart TVs. Overstated. The 15 Android TV boxes were bought, wired together by the researchers and used to run one model in pieces. The self-copying test happened on emulated Android machines in the cloud, with the break-in step made trivial on purpose.
  • Small models could be capable enough by year's end. Accurately reported. That is Anthropic's projection from a capability trend line, and Anthropic calls it a rough estimate.
  • A University of Toronto paper came first. True. Jonas Guan, Nicolas Papernot and colleagues released "AI Agents Enable Adaptive Computer Worms" on June 2, 2026. In 15 runs on a closed 33-host network, their worm reached about 20 hosts per run on average.
  • History of worms. Mostly right. The Morris worm (1988), Stuxnet (late 2000s) and WannaCry are described correctly. "Tens of billions of dollars" for NotPetya and WannaCry is generous. Common estimates are about $10 billion for NotPetya and $4 to 8 billion for WannaCry.
  • Expert quotes. The people quoted hold the roles described, but the quotes come only from the Guardian and we could not check them independently. Anthropic did not comment to the Guardian.

What developers and AI builders should do now

  • Treat everything an agent reads as untrusted. Web pages, emails, files, tool output and other agents' messages can carry prompt injection. Keep system instructions apart from retrieved content, and never let fetched text change an agent's goals or tools.
  • Limit tool permissions. Give each agent the fewest tools it needs. Skip shell and open network access unless the task truly requires them, use short-lived scoped tokens and spending caps, and run code in a sandbox or VM.
  • Keep a human in the loop for anything irreversible. Sending messages, deploying, deleting data, paying, or copying files to another machine should need explicit approval.
  • Filter and watch outputs. Check commands, URLs and secrets before they run or leave the system, and log what agents do. Anthropic notes that a model-carrying worm would move multi-gigabyte files and create unusual device-to-device traffic, which network monitoring can catch.
  • Ship devices with sane defaults. No default passwords, no debug ports such as ADB open to the network, and signed automatic updates. Those basics block AI worms and old-style botnets alike.

Sources