Anthropic: Small Models Could Self-Replicate on IoT Devices by the End of the Year

Anthropic's Frontier Red Team believes small AI models may be only a few months away from being able to self-replicate on commercial IoT devices, from smart ovens to cheap Android TV boxes. In tests, a 9B model ran inference on 8 of 9 hardware types. GLM-5.2 and stronger models complete a simplified replication scenario from start to finish. If small models keep improving at the same pace, they will reach this level by the end of 2026.

Researchers William Zhou and Daniel Freeman describe autonomous replication and adaptation (ARA): a model deploys and spreads itself without human control. Until now, that required a data center with GPUs. The authors show that a powerful accelerator is not necessary.

A worm that carries its weights with it

A classic worm copies itself from machine to machine without human involvement. Earlier work has already shown that an AI agent can scan a network, apply an exploit, and copy model weights to another node of a GPU cluster. In this case the weights become part of the malicious payload: the worm can carry them along or download them again from a public hub, then run inference directly on the compromised hardware.

The authors call such programs weight-based replicators. They see home and office IoT devices as the first targets: these are connected to the internet and have historically been poorly secured.

For a demonstration, the researchers bought 15 cheap Android TV boxes at ~$55 each, linked them into a network, and distributed Gemma4-26B-A4B across them. Each box held two layers of the model. Speed came to 0.39 tokens per second. That is slow, but it works, and the whole rig cost about $825.

How the chain was broken down and what was tested

The researchers split replication into four stages:

• finding targets;
• gaining code execution on the device;
• running inference;
• continuing to spread from the new host.

The authors barely studied the first two stages. CyberGym, ExploitBench, and work on adaptive worms have already shown that small models can handle cyberattacks, especially with the right tools. The focus is on the third stage: whether a model can set up inference on an unfamiliar device by itself.

Models up to 30B parameters already perform many of the individual steps, but they make errors when the steps must be assembled into a single chain. In simplified tests, GLM-5.2 and stronger models complete the entire chain.

Why this is hard to stop

A model that does not fit on one device can be cut into shards and run across several machines. The authors name smart refrigerators, ovens, robot vacuums, and lawn mowers as suitable candidates for a model under 30B. Surveillance cameras and videoconferencing systems are also on the list.

Such a network has no central node that can be switched off. It spreads slowly, with doubling times measured in days. At the same time, unlike conventional malware, an AI worm can figure out unfamiliar devices on its own rather than wait for a ready-made exploit for each model. Among other propagation routes, the authors name theft of API keys and platform credentials, as well as paying for inference through legitimate work such as digital freelancing.

The rest of the study estimates infection speed and the worm's ability to learn during replication. It also compares the threat with pre-AI malware and offers brief defense recommendations.

What manufacturers and defenders should do

The practical takeaway is simple. IoT security is no longer just a matter of DDoS botnets: a full model can now run on these devices. Manufacturers should close default passwords and open services, and make updates mandatory. Network administrators should segment "smart" devices and watch for anomalous traffic between them, since distributed inference requires constant data exchange between nodes. Buyers of cheap TV boxes without firmware support should keep in mind that such a device can become someone else's compute node.