אִם יִרְצֶה הַשֵּׁם
My one-sentence summary, from someone who worked in the literature it quietly extends: Anthropic is describing a k-ary virus whose fragments can also write their own exploits on arrival. That sentence is slightly wrong in a way that matters, and the correction is the interesting part.
Three separate results, not one claim
Most coverage of the October 12 post by Anthropic's Frontier Red Team (Zhou and Freeman) blends three separate experiments into one headline. Only one of them is about replication.
First, distributed inference: Anthropic sharded the 26B-parameter Gemma4-26B-A4B across 15 off-brand Android TV boxes, about $55 each with 4 GB of RAM apiece, under pipeline parallelism, at about 0.39 tokens per second. No datacenter, just commodity junk hardware.
Second, setup on unfamiliar hardware: in the Memento harness, Qwen3.5-9B installed inference on 8 of 9 novel hardware types, and with each generation leaving brief notes for the next, success rose from 45% to between 61% and 84%.
Third, end-to-end replication: GLM-5.2 reached all 8 nodes in 4 of 5 trials (7 in the fifth) on an emulated, firewalled fleet. The dropped caveat: the exploit step was deliberately trivial (an unauthenticated Android debug port), the worm's reasoning ran on a separate server, and Anthropic calls the result an upper bound with no full rogue replicator yet. The end-of-2026 projection is a trend extrapolation off the Epoch Capabilities Index, not a demonstration.
The numbers that belong in the same breath: Kimwolf peaked at over 2 million devices, mostly Android TV boxes; in groups of 15 that is roughly 133,000 copies of the 26B model. Replication doubles in days, a "digital slime mold" in Anthropic's phrase. Weight transfers are multi-gigabyte and visible; in Anthropic's Mirai-based model, ISP quarantine cleared 92% of infections within 14 days.
The pushback belongs here. Former UK NCSC head Ciaran Martin called it interesting work with more than a hint of vendor exaggeration. Georgetown's Jessica Ji frames it as hypothetical, not prediction: likelihood unknown, neither zero nor guaranteed. My objection is sharper: the bottleneck is exploit access, not model capability, and Anthropic held that factor at roughly 1 by making it trivial.
The ancestors: a lottery, a fragmentation scheme, a worm in a lightbulb
The ancestor is 1991: Quisquater and Desmedt published "Chinese lotto as an exhaustive codebreaking machine" in IEEE Computer: hide DES exhaustive-search slices inside millions of consumer devices, each doing a trivial slice, and supercomputer-class capability appears inside commodity infrastructure. Leech revisited it as RFC 3607 in 2003. Anthropic's shard-over-TV-boxes argument is the same substrate move with a workload it was not designed for.
In 2007, Eric Filiol published "Formalisation and implementation aspects of K-ary (malicious) codes" in the Journal in Computer Virology: a family of k files, some not even executable, individually partial and innocuous, whose union constitutes the virus, in sequential or parallel modes. (I did not co-author that paper. I later co-edited and translated, with Filiol, Juergen Kraus's thesis "On self-reproducing computer programs," Journal in Computer Virology 5(1):9-87, 2009, DOI 10.1007/s11416-008-0115-z, contributing its closing section, "Living programs?")
Ronen, O'Flynn, Shamir, and Weingarten ("IoT Goes Nuclear: Creating a ZigBee Chain Reaction," IACR ePrint 2016, IEEE S&P 2017) showed a worm jumping lamp to lamp over ZigBee proximity on Philips Hue bulbs, with a percolation estimate putting critical mass for Paris at about 15,000 lamps (project page). Their worm carried a fixed, human-written firmware exploit. That is the exact thing the 2026 work changes.
One more, from the GenAI branch: Cohen, Bitton, and Nassi's Morris II (2024) coined "AI worm" for self-replicating adversarial prompts moving through GenAI email assistants. Prompt-level propagation, no sharding, no exploit synthesis.
The correction: exploit-on-arrival is not Anthropic's result
Anthropic did not show fragments writing their own exploits on arrival. A separate June 2026 result did: Guan and colleagues in the Papernot group, "AI Agents Enable Adaptive Computer Worms" (arXiv:2606.03811), built a worm whose locally hosted open-weight LLM generates a tailored attack strategy per target, across a 33-host Linux, Windows, and IoT network, synthesizing attack logic at runtime and reading public advisories as it goes. Its own caveat: the reasoning ran on a GPU-class host, not sharded across TV boxes.
So the composed creature, a sharded k-ary body plus on-arrival exploit synthesis, has not been demonstrated in one system. That is the honest core of this post. The scenario was delineated in 2014 to 2016, when the attacker still wrote the exploit. Anthropic's result says shardability is nearly solved; Guan's says exploit-writing is now nearly free. Neither team showed both halves together.
Where the analogy breaks
Four breaks.
First, the Chinese Lottery's search was embarrassingly parallel; LLM inference is sequential and latency-bound, with handoffs between nodes. 0.39 tokens per second is an existence proof, not viability. Anthropic's sharding is novel precisely here, and weakest precisely here.
Second, the ZigBee spread was minutes and proximity-driven; the AI replication cycle is hours to days per hop. Speed, not existence, decides whether quarantine wins. A slime mold loses a race against a 14-day, 92%-clearance quarantine unless per-hop time falls or density rises. One flag: ZigBee percolation is spatial, by radio proximity; IP spread is topological. The open object is not critical mass but shard-cohort survival under churn, whether a 15-box pipeline stays whole long enough to matter, and neither paper publishes that composition.
Third, Anthropic's chain is multiplicative: discovery, access, setup, onward transmission, persistence. A product of factors is not a headline about one factor, and access under non-trivial exploitation is currently unmeasured in Anthropic's setup, so every timeline conclusion inherits an unknown. The chain is a measurement heuristic, not a model: the factors are not independent, and capability growth lifts access too (Guan is the evidence), so "access binds" is a claim about today. The falsifiers below are how it gets rechecked.
Fourth, the k-ary mapping itself. Filiol's fragments are code; a model shard is data, a tensor slice that cannot act alone in any mode. Pipeline coupling cuts the other way from Anthropic's framing: there is no single switch that turns the system off, but a shard cohort has single-node fragility, since one dead box kills its pipeline. And the detection payoff inverts. In Filiol, recognizing which pieces belong together is the hard part; here the interaction is the loudest thing on the network, a handle for the defender, not the attacker. What genuinely transfers from k-ary is one property only: no single node holds the whole capability.
Paper kernel and preregistration
Paper kernel, in my three-public-falsifiers style: end-to-end replication factors as a product over the chain, and the binding constraint is access under non-trivial exploitation, not setup capability and not shardability. Two claims, kept distinct: the existence claim (the composed system is undemonstrated) belongs to this post; the binding-constraint claim belongs to the paper. Three falsifiers test the second:
P1, access dominates: per-hop colonization probability, over 40 hops per rung per agent model, on a ladder from an open debug port (R0) to a hardened target with a seeded synthetic flaw (R3), falls by at least an order of magnitude from R0 to R3. Falsified if the hardest rung retains at least half the trivial rung's success.
P2, the slime mold bound: per-hop cycle time, measured directly (Anthropic's 28 to 150 hours are projected setup times, never cycle time), against Mirai-era quarantine (92% cleared in 14 days): spread loses unless doubling-equivalent time falls under about 3.8 days. Falsified by a measured ratio under 2.0 days.
P3, detect the interaction, not the fragment: per-device detectors score at AUC at most 0.60 (falsified above 0.75), while a fleet-level detector on interaction features alone reaches at least 0.95 at a false positive rate of at most 1% on benign distributed-inference fleets. Falsified under 0.90. Weight transfers are scored separately, since Anthropic already concedes transfers are visible.
The registration, "Access, Not Setup," is frozen and public on OSF: osf.io/k34fe. Hypotheses, design, stopping rules, and analysis plan were fixed before any run; a later amendment, filed on the same project before any data existed, moved the confirmatory runs into emulation under a frozen profile. Owned hardware and emulated targets only, no internet egress, no release of the replicator, vendor disclosure clock. Same methods discipline as Trust, but Replay.
Anthropic described a k-ary virus whose fragments will soon write their own exploits on arrival. Both halves of that sentence are now demonstrated. They have not been demonstrated in the same body, and that gap is where the next experiment should aim.