Edge Compute is Turning Physical AI Into an Attractive Nest for Rogue Agents and Attackers

Malware is not new. Neither is stolen compute. What is new is that AI is erasing the work it takes to adapt an attack to each unfamiliar device. In physical AI, where every robot, vehicle and smart machine runs on a different stack, that work was a real barrier. Without it, rogue AI agents, and the threat actors who borrow their methods, can reach the compute resources that runs real-world operations.

On October 12, Anthropic’s Frontier Red Team published research showing that small open-weight AI models can copy themselves onto internet-connected devices, run there, and keep spreading. In a controlled test, one model spread across all 8 nodes of a network in 4 of 5 trials. Anthropic projects that small models could reach this capability level by the end of 2026.

The test targets were connected TV boxes and similar IoT hardware. But the lessons apply directly to physical AI: humanoid and warehouse robots, autonomous vehicles, delivery drones, industrial smart machines such as robotic arms, and more.

It helps to separate three terms. 

1. Self-replication is a capability: an AI model copying itself onto new devices and running there. That capability creates two distinct risk cases. 
2. A rogue agent is a model that replicates and spreads on its own, with no one directing it. 
3. An AI-enabled attacker is a threat actor who uses the same capability as a tool, with a goal and a target. 

They are related, but not the same, and physical AI leaders need to plan for both.

Once adapting to new hardware no longer takes human effort and can be leveraged for malicious activities, there are two risk cases we wanted to highlight. First, a self-replicating model can move into physical AI fleets on its own, looking for compute to run on. Second, threat actors can use the same capability on purpose, hijacking that compute and then disrupting the operations it runs.

Risk case 1: Rogue agents are moving onto physical AI

In this risk case, no human is in the loop. A self-replicating model spreads because it can, looking for hardware to run on. For physical AI, that changes four things.

Your fleet’s compute is the habitat

The classic risk to physical AI systems is someone stealing data or taking control. A rogue agent wants neither. It wants a place to run.

Robots, vehicles and smart machines carry exactly that. Their compute supports a wide range of AI workloads, from computer vision and sensor fusion to perception, planning and decision-making. More advanced systems are also starting to use vision-language-action (VLA) models and LLMs. Anthropic’s targets included small AI edge computing boards, the same class of accelerators found in many robots and vehicles. The researchers estimate that the edge accelerators of a single leading chipmaker add up to the equivalent of 9,000 to 35,000 high-end data center GPUs.

Every GPU-equipped robot, vehicle, smart machine on the factory floor and edge gateway in your fleet is a potential host.

Proprietary hardware no longer protects you

Physical AI stacks are diverse: custom ECUs, robot controllers, sensor and actuator interfaces, VLA model stacks, bespoke Linux builds. That complexity used to slow intruders down. Each new platform took human time and expertise to figure out.

None of the building blocks are new. Worms have spread on their own for decades. Botnets have conscripted IoT devices at scale since Mirai in 2016. Cryptojacking has quietly stolen processing power for years. All of them share a human bottleneck: someone had to port the code to each new chip, operating system, and device type. AI significantly shrinks that bottleneck. The malicious code can adapt itself to each new system with far less human work. It still has to exploit a vulnerability or find an open door to get in, but once inside, unfamiliar hardware is much less of an obstacle.

The research shows how far that bottleneck has already shrunk. A small AI model got itself running, unaided, on 8 of 9 hardware types tested, from small edge computing boards to desktop computers to gaming GPUs. In Anthropic’s words, unlike traditional malware, an AI replicator “could also figure out unfamiliar devices on its own.”

It gets better as it spreads

When each generation of the model passed notes to the next, its success rate at setting up inference rose from 45% to between 61% and 84%. The agent adapts as it moves. Signatures and fixed rules are written for the threat you saw yesterday.

The impact: a stowaway on the machine’s brain

A rogue agent does not need to mean harm to cause it. On a TV box, a parasitic model wastes electricity. On a robot, vehicle or robotic arm on a production line, an unauthorized AI workload could compete for computing resources also used for perception, planning or other operational functions, depending on how the system is designed.

If critical workloads share computational resources, unauthorized processing could slow down perception, delay operational decisions, or cause system instability. This could disrupt operations and potentially create safety risks.

However, compromising compute resources does not automatically give an attacker control over steering, braking, or other safety-critical functions. The actual risk depends on how the machine is designed, particularly how well AI workloads, operational controls, and safety systems are separated and protected. Weak isolation, excessive system privileges, or unsecured interfaces could allow an attacker to move beyond compute hijacking and interfere with physical operations.

To be clear, Anthropic did not test models interacting with sensors, actuators, or safety systems.

Risk case 2: Threat actors will borrow the playbook

In the second case, a human is very much in the loop. Threat actors use the self-replication capability as a tool, on purpose, against chosen targets. Rogue agents make the headline, but this is the nearer-term risk. It opens a new attack vector against physical AI, and it runs in two stages.

Stage one: hijack the compute

Attackers no longer need to hand-craft an exploit for every platform. A small model that figures out unfamiliar devices on its own becomes an intrusion tool that adapts to whatever it lands on.

Once inside, stolen edge compute has value of its own. It can run an attacker’s models, scale a botnet, or be resold, much as cryptojacking, the covert use of victims’ devices to mine cryptocurrency, turned stolen processing power into revenue. For scale, Anthropic benchmarks against Kimwolf, a real botnet that has hijacked over 2 million connected TVs and set-top boxes, many through the same kind of open debug port. It estimates that a botnet of that size could host about 133,000 copies of an AI model.

Stage two: turn the foothold into disruption

This stage is our own projection, not something Anthropic tested. Compute theft is the entry point, not the endgame. A foothold turns into leverage over operations when three conditions meet: the hijacked compute also runs control tasks, the device has access to the operational network, and separation from the safety system is weak. Then an attacker can degrade performance across a fleet, take machines offline mid-task or halt a production line, then demand payment to restore it.

For physical AI companies, that lands as downtime, missed deliveries and stalled lines, and in the worst case as a safety incident. The building blocks for it are already in place: autonomous device access, adaptation to new hardware, and a foothold on shared compute.

The front door is familiar

The way in was not exotic. Anthropic’s replicator entered through an unauthenticated debug port, a developer interface left open on the device.

Physical AI has plenty of equivalents: diagnostic interfaces, maintenance and service ports, telematics units, connectivity at depots and charging sites, and remote-access gateways on factory OT networks. Fleets also tend to share networks, which is exactly what a worm needs to move from one device to the next.

What both threats have in common

Whether the intruder is a rogue agent or a threat actor (or a combination of both), the signals are behavioral: multi-gigabyte model transfers, sustained device-to-device traffic, unexplained GPU load, thermal and battery anomalies, and creeping latency in perception or planning. But GPU and traffic monitoring alone is not enough, and none of these signals is conclusive on its own. The real test is whether each machine behaves as designed, as built and as operated: a continuous loop that checks it against its intended task, its location, its software state and the behavior of the wider fleet. Heavy compute load on a robot running a scheduled perception task is normal. The same load on a parked robot, running unrecognized software while its peers sit idle, is not.

This is the shift from asking “is this event bad?” to asking “does this behavior make sense?”

What the research does not say

This is not a reason to panic. Anthropic itself describes the results as “signs of life,” not a working replicator in the wild. Leaders should keep four caveats in mind:

• The break-in was made easy on purpose. The exploit step was deliberately trivial, so the results are an upper bound on real-world success.
• It is slow. A full inference setup took an estimated 28 to 51 hours for a 9B model and 71 to 150 hours for a 26B model.
• It is weak. The 26B model ran across 15 TV boxes at roughly 0.3 tokens per second.
• The timeline is an estimate. The end-of-2026 projection rests on a general capability trend, which the authors call a rough proxy.

Slow and weak today does not mean harmless. A replicator operating without a central server can be much harder to detect and contain, as there is no single point that defenders can shut down to stop it from spreading.

Anthropic’s conclusion is that defenders should harden systems and also “prepare to deal with a world where they are here to stay.”

Hardening is table stakes. Behavior is the new perimeter

Most physical AI leaders already have the basics in place: onboard compute treated as an asset to protect, and debug ports and default credentials locked down. Those remain necessary, but they are no longer sufficient. Three moves go further:

1. Verify intended versus actual behavior, for every asset and the fleet. Build an expected state for each asset and for the fleet as a whole: what it should be running, where, on which software, and how it compares with its peers. Continuously compare intended against actual behavior, and verify every deviation before it becomes a safety issue. A learning attacker will not match yesterday’s signature, but it is far harder to hide the gap between what a machine should do and what it does.
2. Contain without crashing. A self-replicating agent may not have a central kill switch, and you cannot simply pull the plug on a robot mid-task. Define the response flow in advance: assess how far the intrusion has spread while containing it where safe to do so. Depending on the machine’s operational state, this may require moving it into a safe mode before restricting connectivity. Once contained, verify that the threat has been removed and the machine can safely return to operation.
3. This works only if safety-critical control runs on isolated compute that stays trusted. Decoy devices can then capture the agent and show how it moves, a tactic Anthropic itself recommends.
4. Map it to your obligations. Since September 11, 2026, the EU Cyber Resilience Act requires manufacturers to provide an early warning within 24 hours of becoming aware of actively exploited vulnerabilities or severe incidents affecting the security of their products.
5. You cannot report what you cannot see.

At Upstream, we have spent a decade securing connected vehicles and the machines around them. Today, we also monitor and secure physical AI fleets, from robots to drones to industrial smart machines. The lesson that holds through every new threat is this: security for physical AI is not anomaly detection. It is continuous operational verification. At every moment, one question matters: are the asset and the fleet still doing what they were intended to do, and doing it safely?

Self-replicating AI makes that lesson urgent. The attacker is starting to think for itself. Our defenses have to understand behavior, not just recognize patterns.