Anthropic just put a date on a threat most security teams have filed under “someday.” The question it leaves open is the one that matters for enterprises: who can actually see the devices it targets?, writes Matt Coleman, the chief revenue officer of Simetric.
A self-replicating AI no longer needs a datacentre
On 12 October, Anthropic’s Frontier Red Team published research by William Zhou and Daniel Freeman showing that small AI models may be months away from copying themselves across cheap IoT devices and running on them. No GPUs required.
The numbers are what make it real. They ran a 26B model across 15 off-brand Android TV boxes, about US$55 each. A 9B model got inference running on eight of the nine hardware types they tested. In a simplified test, one open-weight model replicated end to end across a fleet, and on current trends small models reach that level by the end of 2026.
The difference from Mirai is the part to sit with. A scripted botnet targets one device type. An AI worm figures out unfamiliar hardware on its own, and each copy passes what it learned to the next one.
This isn’t hypothetical. On the night of 11 October, attackers took over internet-connected refrigeration controllers in hundreds of French supermarkets and forced defrost cycles that spoiled food and started fires. Claroty, which warned about this exact risk in August, says AI is shrinking the time attackers need to find vulnerable systems. I wrote about the France attack on LinkedIn. This article is about what comes next: an attacker that is the AI itself.
The devices that never touch your network
Anthropic tested consumer boxes on home networks. But the same class of hardware runs a growing share of the enterprise edge, and much of it connects over cellular: digital signage and kiosks (often Android), EV chargers, remote security cameras, fleet telematics, smart meters, industrial gateways and connected medical devices.
Anthropic itself flags security cameras, video-conferencing units, vehicles and drones as attractive targets, because more of them ship with on-device AI chips. Free compute, sitting in the field.
A cellular device’s traffic goes from the radio to the carrier’s core to the internet. It never crosses your firewall, your switch, your NAC or your SPAN port. Most of these devices can’t run an endpoint agent. To your SOC, they don’t exist.
Why established security platforms miss them
These platforms are built for networks the enterprise owns. Cellular is a network the enterprise rents, so the visibility model breaks.
| Platform | How it sees devices | Where cellular IoT falls through |
|---|---|---|
| Palo Alto Networks | Inspects traffic that passes through its firewalls and SASE | Cellular traffic routed through the carrier straight to the internet never reaches it |
| CrowdStrike | Lightweight agent on the device’s operating system | Modems, meters, gateways and signage players mostly can’t run an agent |
| Cisco security (ISE, Cyber Vision, XDR) | Network access control and sensors on networks Cisco equipment runs | A device on a carrier network never joins those networks |
| ServiceNow + Armis | Passive discovery from network traffic and integrations, feeding the CMDB | Cellular coverage depends on per-provider integrations, and enterprise fleets span many carriers |
ServiceNow closed its roughly US$7.75bn Armis acquisition on 20 April 2026 to “see, decide and act” across the full attack surface. Armis does offer cellular visibility, through an integration with one connectivity provider. A typical enterprise runs its IoT fleet across multiple tier-one operators and a long tail of regional carriers. One integration doesn’t cover that.
None of this is a knock on these platforms. They do what they were designed to do. They just weren’t designed for this.
For cellular IoT, the carrier is the ISP
A useful part of Anthropic’s paper is the defence section. They expect an AI worm spreading across IoT to leave a network signature an ISP could spot: infected devices pulling multi-gigabyte model payloads, sustained traffic between devices that normally never talk, and scanning patterns from propagation.
They also point to what worked against Mirai. One ISP quarantined infected subscribers and cleared 92% of infections within 14 days, versus 74% with no notification.
For cellular devices, the ISP is the carrier. The signal exists, but it’s scattered across every operator’s portal, data format and API. On a SIM, the signature looks like this:
- Usage spikes. A meter that sends a few megabytes a month suddenly pulls gigabytes. A 9B model at 4-bit is roughly 5GB of weights.
- Behaviour that doesn’t match the job. Round-the-clock sessions on a device that reports twice a day.
- New access patterns. Connections and session churn consistent with scanning for the next host.
One carrier at a time, that’s noise. Normalised across every carrier in the fleet, it’s an alert.
Seeing it from the connectivity layer
This is the layer Simetric was built for. We orchestrate connectivity across millions of SIMs on more than 300 mobile network operators, normalised through 1,200+ APIs into one view. That gives security teams three things they can’t get from the network or the endpoint.
- Inventory. Every cellular-connected device, on every carrier, in one place. Including the ones that aren’t on any IT or OT network and never will be.
- Anomaly detection. Policies and machine learning baseline what normal looks like for each device and flag strange access or unusual activity as it happens. An upcoming release takes this further with AI agents.
- Action. Workflows fire when an anomaly is detected: alert the SOC, open the incident in ServiceNow, restrict or suspend the SIM. That last step is the cellular version of the ISP quarantine Anthropic describes.
To be clear about what we don’t do: Simetric doesn’t patch devices. We make sure you know a device exists, see when it misbehaves, and can cut it off before an infection spreads.
And we’re not a replacement for Palo Alto, CrowdStrike or ServiceNow. We’re the data source they’re missing. Feed cellular inventory into the CMDB, anomalies into the SIEM, and quarantine into the SOAR playbook you already run.
Three questions for your security team this week
Anthropic frames defence the way epidemiologists do: drive R₀, the number of new devices each infected one goes on to infect, below 1. You can’t do that for devices you can’t count.
- How many cellular-connected devices do we have, and on how many carriers? If the answer comes from a spreadsheet, that’s your answer.
- Would we know if one device’s data usage jumped 100x overnight? Who gets that alert?
- Can we quarantine a single cellular device in minutes, without opening a ticket with the carrier?
The AI worm Anthropic describes is slow and patient, with a doubling time measured in days. That’s the good news. It means the teams that can see their cellular fleet have time to act. Let’s talk about getting yours visible at Simetric.com.
This is part of a series on connected-device risk. Next up: what the EU Cyber Resilience Act means for anyone building or running connected devices at scale.
Sources
- Anthropic, AI models may be capable of self-replicating without access to a datacenter, William Zhou and Daniel Freeman, 12 October 2026
- ServiceNow, Q1 FY26 results, Form 8-K (Armis close date)
- Armis, Armis + Eseye integration
- BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets, 12 October 2026
This article was written by Matt Colman, Chief Revenue Officer (CRO) at Simetric.
Comment on this article via X: @IoTNow_ and visit our homepage IoT Now
