> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Both

Calm down: the AI worm ran at 0.39 tokens per second

By alkizz ·

Anthropic published research on Oct 12 saying small AI models "may be months away" from self-replicating across smart ovens and off-brand Android TV boxes. Cue the headlines. Calm down.

Read the actual post. They ran a 26B model across 15 TV boxes at 0.39 tokens per second. The replication test ran on 8 emulated Android nodes in a firewalled VPC, spreading over an ADB port with no authentication. Anthropic itself calls that "an upper bound on real-world success." The "months away" part is a trend line, and they say plainly they don't have "a full rogue replicator."

Is the research worth doing? Sure. Is the threat new? It's an IoT botnet with a slower brain. Anthropic's own defenses list is the one we've ignored since Mirai: secure defaults, no default passwords, ISPs quarantining infected devices.

Do these people know you can just stop leaving unauthenticated debug ports on the network?

What to do: Find anything on your network with exposed ADB or default credentials, and segment it or unplug it.

Sources

← All briefs