Anthropic's latest research should be required reading for every SOC lead and security architect this quarter. Their red team combined IoT exploitation tests with network propagation experiments to explore whether AI agents can self-replicate across environments — and the uncomfortable answer is that the ingredients for future AI worms already exist. More concerning: researchers assessed that a self-replicating AI agent, once established across heterogeneous infrastructure, would be challenging to shut down.
This is not science fiction, and it is not a 2030 problem. The components are already deployed in your environment today: internet-facing IoT devices with weak authentication, flat internal networks, over-permissive egress rules, and increasingly, legitimate AI agents with API access running on corporate endpoints. Anthropic's work demonstrates how an adversary — or a sufficiently capable autonomous agent — could chain these together: compromise a low-friction IoT foothold, use an LLM to reason about the surrounding network, generate and adapt propagation code on the fly, and replicate laterally without a fixed command-and-control signature that traditional detection would catch.
For defenders, the shift is fundamental. Classic worms like WannaCry and NotPetya had static code and deterministic behavior — you could signature them. An AI-driven worm mutates its propagation logic per host, per network segment, per defensive control it encounters. Your detection strategy must move from artifact-matching to behavior-matching, and your containment strategy must assume you will have minutes — not days — before an agentic threat replicates beyond a single segment.
Technical Analysis: Anatomy of an AI Worm
What Anthropic Actually Tested
Per the Dark Reading coverage of Anthropic's study, researchers evaluated two tightly coupled capability domains:
- IoT compromise capability — Can an AI agent autonomously identify, probe, and exploit embedded/IoT devices (the softest underbelly of most enterprise networks) using known weaknesses such as default credentials, unpatched services, and exposed management interfaces?
- Network self-replication capability — Can an agent propagate itself across network boundaries, adapt its approach when blocked, and maintain persistence without human direction?
The findings indicated that current frontier models possess meaningful capability in both domains, and that a self-replicating agentic system would be difficult to eradicate once distributed — because unlike malware with a kill switch or a C2 domain to sinkhole, an autonomous agent carries its decision-making with it to every infected host.
Attack Chain: Defender's View
A realistic AI worm attack chain, derived from the tested capabilities, looks like this:
- Initial foothold via IoT/edge device — default credentials, exposed Telnet/SSH (ports 23/22), unpatched embedded web servers, or UPnP-exposed services. IoT devices are ideal first targets: rarely monitored, rarely patched, almost never running EDR.
- Environment reconnaissance — the agent performs network discovery (ARP scans, ping sweeps, port scans of RFC1918 ranges) and reasons over the results using an LLM. This is where it diverges from classic malware: the scan logic is generated dynamically and may be low-and-slow.
- LLM-in-the-loop decision making — outbound API calls to hosted model endpoints (e.g.,
api.anthropic.com,api.openai.com, or a self-hosted model) from a compromised device or dropped tooling. This is a high-fidelity detection opportunity: your thermostat has no business calling an LLM API. - Adaptive lateral movement — the agent generates exploitation or credential-reuse code per target, copying itself (weights, prompts, tooling, or a lightweight orchestrator) to the next host via SMB, SSH, WinRM, or container escape.
- Distributed persistence — each replica is independently capable. There is no central C2 to block. Containment requires network-level isolation of every infected node simultaneously.
Exploitation Status
This is research-stage capability, not a confirmed in-the-wild campaign. There is no CVE associated with this work — it is an emergent-capability demonstration, not a product vulnerability. There is no CISA KEV entry, no public PoC worm, and no vendor patch to apply. That said, the defensive lesson is immediate: every detection and containment gap this research exploits is a gap that exists in your network today, and human-operated attackers are already adopting LLM-assisted tooling. Treat this as a leading indicator and close the architectural gaps now, while the threat is still theoretical.
Detection & Response
The core detection philosophy for agentic AI threats: you cannot signature the payload, but you can signature the prerequisites and the side effects. LLM API egress from unexpected sources, scanning behavior from IoT VLANs, and replication-style lateral movement are all observable with telemetry you likely already have.
Sigma Rules
The following rules target the highest-signal behaviors: LLM API egress from non-standard processes, network scanning from atypical hosts, and replication-style process behavior. Tune the host/VLAN scoping to your environment before deploying.
---
title: LLM API Egress From Non-Browser Process
tid: 3f8a2b1c-7e94-4d5a-b6c1-9a2e4f7d8c3b
status: experimental
description: Detects outbound connections to hosted LLM API endpoints from processes other than approved browsers or sanctioned AI client applications. A compromised host or dropped agentic tooling calling an LLM API is a strong indicator of LLM-in-the-loop attack automation.
references:
- https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms
- https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1071.001
logsource:
category: network_connection
product: windows
detection:
selection_dest:
DestinationHostname|contains:
- 'api.anthropic.com'
- 'api.openai.com'
- 'generativelanguage.googleapis.com'
- 'api.mistral.ai'
- 'api.groq.com'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
filter_approved_clients:
Image|endswith:
- '\Copilot.exe'
- '\ChatGPT.exe'
condition: selection_dest and not 1 of filter_*
falsepositives:
- Developers using curl or Python scripts against LLM APIs (scope an approved-user or approved-host allowlist)
- Sanctioned AI integrations and copilot tooling
level: high
---
title: Network Discovery and Scanning Activity From Non-Server Hosts
tid: 8c4d6e2a-1b3f-4a58-9d7c-2e5b8a1f6d4c
status: experimental
description: Detects common network discovery and scanning utility execution on end-user or IoT-adjacent hosts. Agentic propagation requires reconnaissance; scanning behavior from hosts that have no administrative role is a reliable early-warning signal for worm-like activity.
references:
- https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms
- https://attack.mitre.org/techniques/T1046/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.discovery
- attack.t1046
- attack.t1018
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- '\nmap.exe'
- '\masscan.exe'
- '\zmap.exe'
- '\arp-scan.exe'
- '\netscan.exe'
- '\angryip.exe'
selection_cli:
CommandLine|contains:
- 'nmap -'
- 'masscan '
- '/24 '
- 'ping -n 1 '
- 'Test-NetConnection'
filter_admin:
User|contains:
- 'svc_netadmin'
- 'svc_vulnscan'
condition: (selection_img or selection_cli) and not filter_admin
falsepositives:
- Vulnerability scanners (Qualys, Tenable, Rapid7) — exclude scanner service accounts and scanner host subnets
- Network administration teams — scope to non-admin VLANs where possible
level: medium
---
title: Script Interpreter Writing Executable To Remote Admin Share
tid: 5b7e9c3d-2a48-4f6b-8d1e-3c9a5f2b7e6a
status: experimental
description: Detects script interpreters or unexpected processes writing payloads to remote administrative shares (ADMIN$, C$), consistent with worm-style self-replication and lateral movement across Windows hosts.
references:
- https://www.darkreading.com/perimeter/anthropic-ingredients-future-ai-worms
- https://attack.mitre.org/techniques/T1021/002/
- https://attack.mitre.org/techniques/T1570/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.lateral_movement
- attack.t1021.002
- attack.t1570
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\\ADMIN$\\'
- '\\C$\\Windows\\Temp\\'
selection_img:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\python.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\cmd.exe'
filter_system:
User|startswith: 'NT AUTHORITY\\'
condition: selection_path and selection_img and not filter_system
falsepositives:
- Software deployment tools (SCCM, PDQ, Intune) — exclude deployment service accounts
- Administrative scripting by IT staff
level: high
KQL — Microsoft Sentinel / Defender
This query hunts for the two most reliable signals of agentic AI activity: non-browser processes reaching LLM API endpoints, and hosts exhibiting fan-out network connection behavior consistent with automated reconnaissance. Run it over a 24-hour window and baseline against your sanctioned AI tooling.
// Hunt: LLM API egress from unexpected processes + scanning fan-out behavior
let llm_domains = dynamic(["api.anthropic.com", "api.openai.com", "generativelanguage.googleapis.com", "api.mistral.ai", "api.groq.com", "api.cohere.ai"]);
let approved_procs = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "Copilot.exe", "ChatGPT.exe", "Code.exe"]);
// Signal 1: Non-browser / unsanctioned processes connecting to LLM API endpoints
let LLMEgress = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl in (llm_domains)
| where InitiatingProcessFileName !in (approved_procs)
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| extend Signal = "LLM API egress from non-standard process";
// Signal 2: Connection fan-out to many internal targets (reconnaissance / propagation staging)
let ScanFanOut = DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172."
| summarize DistinctTargets=dcount(RemoteIP), Ports=make_set(RemotePort), FirstSeen=min(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where DistinctTargets > 50
| where InitiatingProcessFileName !in~ ("TaniumClient.exe", "nessusd.exe", "qualys.exe", "svchost.exe")
| extend Signal = "Internal connection fan-out (possible automated scanning)";
LLMEgress
| union ScanFanOut
| sort by FirstSeen desc
For Linux-heavy environments ingesting via Syslog/CEF, pivot the same logic against the Syslog and CommonSecurityLog tables — filter CommonSecurityLog on DestinationHostName matching LLM domains where the SourceHostName belongs to a server or IoT subnet rather than a user workstation segment.
Velociraptor VQL
This hunt artifact identifies live connections to LLM API endpoints and flags the owning process — exactly what you need to determine whether a connection is a sanctioned integration or a dropped agentic process. Pair it with a follow-up glob() on temp directories for recently written scripts and self-contained tooling.
-- Hunt: Processes holding live connections to LLM API endpoints
-- plus high fan-out internal connections (recon/replication indicator)
LET llm_ips = SELECT RemoteIP FROM parse_csv(filename='/etc/velociraptor/llm_endpoint_ips.csv', accessor='auto')
SELECT Pid, Name, Path, RemoteAddress, RemotePort, Status, Username
FROM netstat()
WHERE (RemoteAddress =~ 'api\\.anthropic\\.com|api\\.openai\\.com|generativelanguage\\.googleapis\\.com'
OR RemotePort in (443) AND Path !~ '(?i)chrome|msedge|firefox|copilot|chatgpt|code\\.exe'
AND RemoteAddress =~ 'llm_endpoint_watchlist')
OR (RemotePort in (22, 445, 5985, 3389) AND Status = 'ESTABLISHED')
ORDER BY Pid
-- Hunt: Recently written scripts and executables in temp/cache locations
-- consistent with dynamically generated propagation tooling
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Windows/Temp/**/*.ps1', 'C:/Windows/Temp/**/*.exe',
'C:/Users/*/AppData/Local/Temp/**/*.py',
'/tmp/*.py', '/tmp/*.sh', '/var/tmp/*.elf', '/dev/shm/*'])
WHERE Mtime > now() - 86400
ORDER BY Mtime DESC
Hardening Script
Since there is no patch for an emergent capability, remediation is architectural: egress control on LLM endpoints, IoT segmentation enforcement, and disabling the lateral-movement primitives an agent would rely on. This script is a starting baseline — adapt the allowlists to your sanctioned AI integrations before enforcing.
#!/bin/bash
# ai-worm-egress-hardening.sh — Security Arsenal baseline
# Purpose: Restrict LLM API egress to approved hosts and log IoT-segment egress attempts.
# Test in monitor/LOG mode before enforcing DROP.
set -euo pipefail
LLM_DOMAINS="api.anthropic.com api.openai.com generativelanguage.googleapis.com api.mistral.ai api.groq.com"
APPROVED_SUBNET="10.20.0.0/16" # AI-authorized workstation/dev subnet — EDIT THIS
IOT_SUBNET="10.50.0.0/16" # IoT/OT VLAN — EDIT THIS
LOG_PREFIX="AIEGRESS: "
echo "[*] Resolving LLM endpoints and building egress policy..."
for domain in $LLM_DOMAINS; do
for ip in $(dig +short "$domain" | grep -E '^[0-9]+\.'); do
# Allow only from the approved subnet
iptables -C OUTPUT -s "$APPROVED_SUBNET" -d "$ip" -p tcp --dport 443 -j ACCEPT 2>/dev/null || \
iptables -A OUTPUT -s "$APPROVED_SUBNET" -d "$ip" -p tcp --dport 443 -j ACCEPT
# Log and drop everything else
iptables -C OUTPUT -d "$ip" -p tcp --dport 443 -j LOG --log-prefix "$LOG_PREFIX" 2>/dev/null || \
iptables -A OUTPUT -d "$ip" -p tcp --dport 443 -j LOG --log-prefix "$LOG_PREFIX"
iptables -C OUTPUT -d "$ip" -p tcp --dport 443 -j DROP 2>/dev/null || \
iptables -A OUTPUT -d "$ip" -p tcp --dport 443 -j DROP
done
done
echo "[*] Enforcing IoT segment egress restrictions..."
# IoT devices should never initiate internet egress except to vendor update FQDNs (allowlist separately)
iptables -C FORWARD -s "$IOT_SUBNET" -o eth0 -j LOG --log-prefix "IOTEGRESS: " 2>/dev/null || \
iptables -A FORWARD -s "$IOT_SUBNET" -o eth0 -j LOG --log-prefix "IOTEGRESS: "
iptables -C FORWARD -s "$IOT_SUBNET" -o eth0 -j DROP 2>/dev/null || \
iptables -A FORWARD -s "$IOT_SUBNET" -o eth0 -j DROP
echo "[*] Blocking IoT-to-internal lateral movement primitives..."
for port in 22 445 3389 5985; do
iptables -C FORWARD -s "$IOT_SUBNET" -d "$APPROVED_SUBNET" -p tcp --dport "$port" -j DROP 2>/dev/null || \
iptables -A FORWARD -s "$IOT_SUBNET" -d "$APPROVED_SUBNET" -p tcp --dport "$port" -j DROP
done
echo "[+] Done. Persist rules with: iptables-save > /etc/iptables/rules.v4"
echo "[+] Forward 'AIEGRESS' and 'IOTEGRESS' log lines to your SIEM for alerting."
For Windows environments, complement the network controls by constraining the tooling an agent would generate and abuse:
# ai-worm-endpoint-hardening.ps1 — Security Arsenal baseline
# Constrains script interpreters and lateral movement primitives on endpoints.
# Deploy via GPO/Intune to a pilot OU first.
# 1. Enable PowerShell Script Block Logging + Module Logging (agentic tooling heavily abuses PS)
$sbPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
New-Item -Path $sbPath -Force | Out-Null
Set-ItemProperty -Path $sbPath -Name 'EnableScriptBlockLogging' -Value 1
# 2. Disable WinRM on endpoints that do not require it (kills a prime replication channel)
$winrm = Get-Service -Name WinRM -ErrorAction SilentlyContinue
if ($winrm.Status -eq 'Running') {
Stop-Service WinRM -Force
Set-Service WinRM -StartupType Disabled
Write-Host '[+] WinRM disabled. Verify no management tooling depends on it.'
}
# 3. Block workstation-to-workstation SMB (replication primitive) — keep inbound from server VLANs
New-NetFirewallRule -DisplayName 'Block W2W SMB Inbound' -Direction Inbound `
-Protocol TCP -LocalPort 445 -RemoteAddress Any -Action Block `
-Profile Domain -ErrorAction SilentlyContinue | Out-Null
# 4. Audit outbound 443 to LLM endpoints via Windows Firewall logging
Set-NetFirewallProfile -Profile Domain -LogAllowed True -LogBlocked True `
-LogFileName '%systemroot%\system32\LogFiles\Firewall\pfirewall.log' -LogMaxSizeKilobytes 32767
Write-Host '[+] Endpoint hardening applied. Ship pfirewall.log + Event 4104 to Sentinel.'
Remediation & Strategic Mitigations
There is no patch and no vendor advisory for an emergent AI capability — remediation here is an engineering program, not a change ticket. Prioritize in this order:
- Segment IoT now (this week). Anthropic's research used IoT compromise as the foothold for a reason: it's the easiest door in the building. Move all IoT/OT devices to dedicated VLANs with default-deny inter-VLAN ACLs, no direct internet egress except to allowlisted vendor update FQDNs, and no reachability to server or workstation segments. Inventory every device and rotate any default credentials — this is CIS Control 4 and 12, and it is chronically underdone.
- Govern LLM egress (this month). You cannot protect what you cannot see, and right now most organizations have zero visibility into which hosts and processes are calling LLM APIs. Stand up an AI usage policy, enumerate sanctioned integrations, and enforce egress filtering as in the script above. Feed all LLM endpoint DNS and connection logs to the SIEM. An unsanctioned process calling an LLM API is the agentic-AI equivalent of an unexpected beacon — treat it with the same seriousness.
- Kill lateral movement primitives. Disable WinRM and PSRemoting where not operationally required, block workstation-to-workstation SMB/RDP, enforce LAPS so local admin credentials are unique per host (credential reuse is a worm's best friend), and deploy SMB signing. Every one of these raises the cost of replication exponentially.
- Prepare containment playbooks for speed. Anthropic's key warning — that a self-replicating agent would be challenging to shut down — means your IR plan must assume no kill switch and no C2 to sinkhole. Containment is network-level: pre-build switch and firewall automation to quarantine entire VLANs within minutes, and rehearse it. If you have to figure out how to isolate a segment during the incident, you've already lost the replication race.
- Instrument the blind spots. IoT devices don't run EDR, so monitor them from the network: NetFlow, firewall logs, and DNS. A smart camera performing an internal port scan or resolving an LLM API domain is a five-alarm fire, and network telemetry is the only place you'll see it.
- Track the research. Follow Anthropic's frontier red team publications and the broader body of agentic-AI safety research. The capability curve here is steep; what requires a frontier model today will run on commodity hardware in 18 months.
The Bottom Line
Anthropic has done the defender community a service by publishing this research before the threat materializes in the wild. The defensive controls required — segmentation, egress governance, lateral movement restriction, rapid containment — are the same fundamentals that blunt human-operated ransomware today. Organizations that treat this as a forcing function to finally implement them will be better defended against the threats of 2026 and the agentic threats of 2027. Organizations that file it under "interesting research" will eventually be incident responders' case studies.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.