Anthropic warns small AI may self-replicate on IoT

Anthropic says small AI may be months from self-replicating

On October 12, 2026, Anthropic published research suggesting that small AI models may be only months away from copying themselves onto off-the-shelf IoT devices. Here, IoT means internet-connected gadgets such as smart ovens, streaming boxes and security cameras. The post comes from Anthropic's Frontier Red Team, the group that tests models for dangerous capabilities, and was written by William Zhou and Daniel Freeman.

The researchers single out off-brand Android TV boxes. These are cheap, sold in huge numbers, and often ship with little or no security built in.

An AI worm that runs its own weights on hijacked devices

The scenario Anthropic studies is a worm that carries an AI model with it, runs that model on each device it takes over, and uses it to find the next device. Anthropic calls this a weight-based replicator. The weights are the learned numbers that make up a trained model, so in this case the malware payload is the model itself.

The broader idea, a model spreading and adapting outside human control, is known as autonomous replication and adaptation (ARA). Such a worm would have no central server to switch off. It would also be slow, with the number of infected devices doubling over days rather than minutes.

What's new is adaptability. Ordinary malware is written for specific hardware, while a model could work out on its own how to run on a device it has never seen.

Models under 30B can already handle many of the steps

According to the research, models of 30 billion parameters (30B) and under can already complete many of the individual steps a replicator needs. Parameters are the numbers a model learns during training. More parameters usually means a more capable model, but also one that costs more to run.

What these small models cannot yet do reliably is chain every step together from start to finish. That sets this apart from the document-based AI worm we covered earlier, which spread through Copilot rather than carrying a model of its own (Related reading: AI Worm: A Word Document That Copies Itself).

Fifteen $55 TV boxes ran a 26B model

Anthropic showed that a pile of cheap IoT devices can run a 26-billion-parameter model without any data center hardware. The point of the experiment was compute: whether bargain gadgets, networked together, have enough memory and processing power to host a capable model at all. A second experiment tested whether a small model can get itself running on hardware it does not know.

Split by layer, the model ran at 0.39 tokens per second

The team bought 15 off-brand Android TV boxes at about $55 each, networked them, and ran Google's Gemma4-26B-A4B across all of them. Each box had 4GB of memory, the high end for boxes at this price, which usually ship with 1 to 4GB. That was still too little for the whole model, so it was split by layer, two layers per box.

The cluster produced 0.39 tokens per second. A token is a small chunk of text, so that is slow, but the model did run.

A 9B model got inference running on 8 of 9 devices

A worm that lands on a new device has to get its model running there before it can do anything else. Running a trained model to produce output is called inference. Anthropic asked Qwen3.5-9B, a 9-billion-parameter model, to set up inference by itself on unfamiliar hardware.

The test hardware ranged from an NVIDIA Jetson Nano to Macs and a PC with an RTX 4090. Qwen3.5-9B got inference working on 8 of the 9 types. The researchers add that the chips themselves are not the danger and have no special flaw.

Only GLM-5.2 finished the replication test

Of the open-weight models Anthropic tested, only GLM-5.2 could carry out the whole replication chain, from connecting to a node to getting inference running there. It did so consistently, reaching all 8 nodes in 4 of 5 runs and 7 in the remaining one. The other models failed just as consistently.

The test used password-free ADB connections

The replication run did not use real consumer devices. Anthropic set up 8 Google Cloud nodes on an isolated network and ran an Android 15 emulator on each, so every node looked like a cheap handset or TV box.

The nodes were reachable over ADB, the debugging port used to control Android devices remotely, with no password required. Because the hard part of breaking in was taken away, Anthropic treats the result as an upper bound on real-world success.

GLM-5.2 also did not run on the nodes. It was too large for them, so it ran on a separate inference server.

Each new node was set up to run Llama3.1-8B, an 8-billion-parameter model. The question was whether a small model with GLM-5.2's skills could spread itself, not whether GLM-5.2 fits on a TV box.

The researchers also note that real IoT security may not be much harder than the step they skipped. The Mirai botnet spread through huge numbers of devices simply by trying a list of default passwords set by manufacturers.

The end-of-2026 date is a forecast, not a result

Everything from here on is a projection, not an experiment. Anthropic grouped open models of 30B and under by release date and tracked them on the Epoch Capabilities Index (ECI), a general measure of model ability. If GLM-5.2 marks the minimum needed for replication, small models would reach it by the end of 2026, assuming the historical trend holds.

The researchers say plainly that ECI only stands in for replication skill and that the date is a rough estimate. The "months away" line at the top of the post rests on this projection.

A slow spread with no central off switch

A worm like this would be hard to shut down because there is no single point to switch off, but Anthropic expects it to spread slowly, doubling over days. The researchers compare it to slime mold or a swarm of fruit flies: a population that grows over days and has no head to cut off.

Each new device takes a day or two to set up

Using the speeds measured on the TV boxes, Anthropic estimated how long a worm would need to set up inference on a single new device. Qwen3.5-9B would take 28 to 51 hours and Gemma4-26B-A4B 71 to 150 hours. Even a 9B worm would need more than a day or two for each copy.

The combined compute would be small, too. The Kimwolf botnet, a set of hijacked devices controlled together, peaked at more than 2 million machines, mostly Android TV boxes. Running AI on that many boxes would give about the inference power of 40 H100 data center GPUs, by Anthropic's estimate.

Notes from earlier generations raised the success rate

In Anthropic's tests, worms that passed notes to their successors got better at setting up inference. Each Qwen3.5-9B instance recorded what it tried and what failed. The next instance read those notes before making its own attempt.

Over 6 generations, the success rate rose from 45% in the first to between 61% and 84% in later ones. Letting the small model ask a stronger model, Opus 4.8, for advice did not clearly help. The researchers think the small model did not know what to ask.

Researchers say ISPs can spot the traffic

Anthropic argues that a worm multiplying across IoT devices would show up as an anomaly in the flow monitoring that internet service providers (ISPs) already run. Each new infection means downloading a model several gigabytes in size, and devices that normally stay quiet start talking to each other for long stretches.

There is a precedent for acting on that signal. During Mirai, ISPs that quarantined infected subscribers and told them about it saw 92% of infections cleared within 14 days, compared with 74% when customers were not notified.

Manufacturers can also shrink the pool of easy targets. In the UK, for example, shipping IoT devices with default passwords is no longer compliant. Fixing factory settings works against AI worms and old-style botnets alike.

What to check on smart devices at home and work

Anthropic's point about default passwords, together with keeping devices patched, is something companies and staff can act on now. Companies can do it through what they buy, and staff through how they set devices up. In the US, the FCC's U.S. Cyber Trust Mark lets buyers check both before a purchase.

The FCC sought public comment on the program in August 2023 and adopted the rules that set it up in March 2024. The label is voluntary and covers wireless consumer IoT products such as home security cameras.

Companies can look for the U.S. Cyber Trust Mark

When a company buys cameras, routers or other connected devices, the U.S. Cyber Trust Mark is a quick way to tell which products meet a federal security baseline. Products that qualify carry the logo along with a QR code. Scanning it opens a registry entry that lists how long the product will get support and whether security updates install automatically.

Applications are evaluated by approved third-party label administrators, and accredited labs handle the compliance testing. The label describes the product as shipped. Whoever runs the device still has to keep it updated.

Staff should change default passwords and keep updates on

Anyone using connected devices at home or at work should change the password each one shipped with and keep its firmware (the software that runs it) up to date. The Cyber Trust Mark registry is meant to spell out how to do both for each product: how to change the default password, how to set the device up securely, and whether updates are automatic.

That also applies to the router and cameras in a home office. If a device no longer gets updates from its maker, replace it rather than give it another year on the network.

The way in is still the factory password

As long as AI worms get in through factory settings, a device with a new password and current firmware stays a much harder target, however capable the model gets. The way in during Anthropic's test was a port with no password at all. Mirai took over its devices the same way, with passwords nobody had changed since the box left the factory.

Only small models fit on these devices, and each hop takes days. That leaves time to check, starting today, whether the gadgets in your home and office still run on their shipping settings.