Anthropic has warned that small artificial intelligence models could be months away from gaining the ability to copy themselves across internet-connected consumer devices without human control or access to data centers.
The company’s Frontier Red Team published a research report on October 12 examining whether AI models could independently find devices, transfer model files, establish the software needed to operate, and continue spreading from each newly infected machine .
Researchers said models with fewer than 30 billion parameters can already complete many individual stages of that process, though most still struggle to combine them reliably .
‘We don’t yet have a full rogue replicator,’ researchers William Zhou and Daniel Freeman wrote in the report .
Experiments Show Capability Across Inexpensive Hardware
In one experiment, Anthropic ran the Gemma4-26B-A4B model, which has approximately 26 billion parameters, across 15 off-brand Android TV boxes costing about $55 each .
The devices were networked together, with each box handling a portion of the model’s computation. The system generated text at 0.39 tokens per second .
In a separate test, a smaller 9-billion-parameter model successfully established the software needed to run inference on eight of nine hardware types tested, including devices such as NVIDIA Jetson Nano and Apple Silicon Macs .
Anthropic also built a simulated network of eight Google Cloud nodes running Android 15 emulators. A model called GLM-5.2 completed the full replication sequence across all eight nodes in four of five trials, reaching seven nodes in the remaining trial .
However, GLM-5.2 ran on a separate inference server during the experiment. The emulated nodes were too small to hold the larger model, and the test established a smaller model called Llama3.1-8B on each target device .
The researchers also simplified the hacking stage by using devices with an unsecured Android Debug Bridge port that required no authentication, meaning the results do not demonstrate reliable replication under real-world conditions .
Timeline and Technical Constraints
Anthropic estimated that if smaller models continue improving at their historical rate, they could reach the capability demonstrated by GLM-5.2 by the end of 2026 . The company cautioned that this timeline is a rough projection based on general capability trends, not a guaranteed outcome .
The report identified a gap between the intelligence needed for reliable replication and the maximum model size that target hardware can support. Models capable of completing the replication sequence are not currently small enough to run on inexpensive devices, while models that fit within those devices’ memory budgets cannot reliably complete the entire process .
A self-replicating AI system would be difficult to shut down because it would lack a single central control point, unlike conventional AI services that can be disabled by turning off servers .
Unlike non-AI malware, such a system could also adapt to unfamiliar devices on its own and pass successful strategies to future copies of itself .
Anthropic researchers said the spread of such a worm would likely be slow, with the number of infected devices potentially doubling every few days .
Potential Targets and Defenses
The report focused on Internet of Things devices, which are typically poorly secured and designed for continuous operation. Potential targets include smart ovens, smart TVs, refrigerators, automatic vacuum cleaners, security cameras, and video-conferencing equipment .
Anthropic recommended strengthening device security, monitoring unusual network traffic, and isolating infected machines to limit potential spread .
‘We should aim to harden our systems to make it difficult for such replicators to spread,’ the researchers wrote, ‘but also prepare to deal with a world where they are here to stay’ .
Mixed Expert Reaction
Cybersecurity experts offered divided assessments of the research.
Ciaran Martin, a former head of Britain’s National Cyber Security Centre, said the report came across as an ‘interesting technical paper with a more than hint of vendor exaggeration’ .
‘We managed to run a small model on cheap TVs,’ Martin said, ‘does not a security crisis make’ .
Gregory Kurtzer, founder of Rocky Linux and CEO of software company CIQ, wrote on X that the experiment was engineered to succeed and even then failed to demonstrate the headline claim. He noted that access to target machines was deliberately left unauthenticated .
‘Stop confusing speculative scenarios with demonstrated capabilities,’ Kurtzer wrote. ‘Fear isn’t evidence’ .
Zhengxiong Li, an assistant professor of computer science and engineering at the University of Colorado Denver, said he found it worrying that an AI could effectively become a worm capable of improvising ways to hijack devices. ‘If it runs across many devices without depending on a central service, there may be no single place to shut it down,’ Li said .
Jessica Ji, a senior research analyst at Georgetown’s Center for Security and Emerging Technology, said it made sense to consider the possibility of AI models proliferating autonomously, but that the likelihood remains unknown. ‘It’s not zero, but nor is it guaranteed,’ she said .
The report follows a September warning from Anthropic CEO Dario Amodei, who said that within the next year or sooner, AI might be able to hijack ‘the entire internet’ with ‘a persistent botnet’ .
1 thought on “Anthropic Warns Small AI Models Could Self-Replicate on Smart Devices Within Months.”