AI self-replication is moving from theory to a device problem health care already knows
Anthropic researchers have put a sharper edge on a threat that has hovered around cybersecurity briefings for years: small AI models may soon be able to move from one poorly secured internet-connected device to another without human direction. The work matters to medicine because health care runs on the kind of networked hardware that attackers prize — cameras, conferencing units, edge devices, and older equipment that often stays in service long after software support ends.
The research team did not test medical devices, but the security conditions they examined will sound familiar in clinics and hospitals. Default credentials, outdated software, and patch cycles that lag behind deployment are not abstract problems in health care. They are routine operational weaknesses, and they create the opening an autonomous malicious model would need.
The most unsettling part is not simply that AI can assist an intrusion. It is that a model could increasingly carry out the full chain on its own.
Cheap hardware, open ports and enough capacity to keep going
To demonstrate what compact models can already do, researchers assembled 15 inexpensive Android TV boxes, each costing about $55, and networked them together. Split across that hardware, a 26 billion-parameter model generated 0.39 tokens per second. The speed was slow, but it was functional, which is the point that should concern clinicians responsible for connected systems: modest hardware can still host meaningful AI workloads when the attacker is willing to distribute the model across multiple devices.
Separate testing went further. A 9 billion-parameter model was able to set up AI inference on eight of nine hardware types, including small edge computing boards, Mac computers, and consumer graphics cards. In another contained experiment involving eight emulated Android devices, one of the larger open models successfully spread from machine to machine and got itself running at each stop, reaching all eight nodes in four of five trials. Smaller models still struggled to complete the full cycle reliably, but the trend line points in one direction.
The experimental design also matters. The devices were deliberately left with an open port that required no authentication, which makes the attack path simple and the results favorable to the intruder. Even so, the comparison to earlier botnets is hard to miss. Mirai spread by trying default usernames and passwords, and that old pattern is still common enough in everyday device management to remain relevant.
Why hospitals and medical practices should care now
An AI-driven worm would not behave like conventional malware built for one device family or one operating system. A traditional botnet usually depends on a known exploit path and a fixed target profile. An adaptive model changes the equation because it could reason through unfamiliar hardware, infer how to operate on a new system, and attempt to keep moving without waiting for a human operator.
In practical terms, that could make security cameras and video-conferencing units attractive targets. Both are common in hospitals and medical offices, and many now ship with embedded AI accelerators that make them capable hosts for compact models. The researchers estimated that roughly 9.5 million units with edge AI accelerators are in use worldwide, though most are not directly reachable from the internet. Even devices that never touch patient data can still provide a foothold into the broader network if segmentation is weak.
Clinical environments are especially exposed because older equipment often remains operational for years after the vendor stops sending updates. Imaging peripherals, smart monitors, building systems, and telehealth devices may all share the same network architecture even when they serve very different purposes. Once one device is compromised, the attack surface expands toward scheduling systems, administrative tools, and in the worst case, systems containing patient information.
Replication speed may be slow, but the outbreak logic is familiar
The near-term threat described in the research is not a lightning-fast digital contagion. Replication could take a day or more per step, which may sound slow compared with familiar ransomware events. In epidemiologic terms, though, slow spread does not eliminate danger. A worm that can persist, adapt, and keep finding weak devices can become a chronic operational burden rather than a single disruptive event.
Researchers used the phrase “digital slime mold” to describe that behavior, and the comparison is apt. The danger lies less in a dramatic burst than in a distributed presence that is difficult to remove because there is no central server to cut off. Each compromised device becomes both a host and a relay point.
The projection is also time-sensitive. Based on historical trends, the team estimated that models small enough to run on cheap devices could reach the necessary capability by the end of 2026. For practices that still have not fully mapped their connected equipment, that timeline leaves very little room for complacency.
Defense depends on making spread mathematically unattractive
The defensive framework in the report borrows from outbreak control. Security teams need each infected device to transmit to fewer than one other device on average if they want the spread to die out rather than become entrenched. In other words, containment has to work like public health surveillance: identify the path, break the chain, and reduce the number of viable hosts.
Several defensive advantages already exist. Large AI model files moving between devices should generate unusual traffic patterns that monitoring systems can detect. A worm that has to copy multigigabyte payloads will not look like ordinary background noise for long. The researchers also pointed to the cleanup of the Mirai botnet, where an internet service provider quarantined infected customers and notified them; that effort cleared 92% of infections within 14 days.
Policy can help at the source as well. The researchers cited a U.K. law that bars default passwords on connected consumer products, a reminder that secure-by-default design reduces the burden on end users. In health care, though, responsibility still falls heavily on the organizations operating the devices.
The most concrete advice remains the same, and it is still unevenly followed: keep an accurate inventory of every connected device, change default credentials, segment medical and building devices away from systems that store patient data, apply manufacturer patches promptly, and retire equipment that can no longer be updated. A 2022 survey covered by Medical Economics found that 57% of health care organizations do not always change default usernames and passwords on new connected devices, while 68% do not always apply patches when they are available. Those gaps are not theoretical. They are the kind of gaps a self-replicating AI could exploit first.
The question for health systems is no longer whether connected devices expand efficiency. They do. The harder question is how many of those devices are quietly running on assumptions that malware was built to exploit years ago, and how many still can be updated before that assumption becomes a breach.