AI Safety

Anthropic: Small AI May Soon Self-Replicate on IoT Devices

Oct 13, 2026·5 min read·By Rahish Saifi

On October 12, 2026, Anthropic researchers William Zhou and Daniel Freeman published a Frontier Red Team study on whether AI models can self-replicate without datacenter access—by compromising cheap, poorly secured internet-of-things (IoT) hardware. Their experiments suggest small models may be months away from being capable enough to pull off that chain on commercial devices such as smart ovens and off-brand Android TV boxes. Coverage on October 13 from Al Jazeera (John Power) and India Today (Armaan Agarwal) highlights the same headline risk: replication that does not depend on stealing cloud API keys or breaching a GPU farm.

Anthropic is not reporting a rogue worm loose on the public internet. The post is a controlled red-team assessment of autonomous replication and adaptation (ARA)—and the authors argue the ingredients are starting to line up on the edge.

What Anthropic is warning about

The threat model they emphasize is a weight-based replicator: malware that carries (or re-downloads) model weights and runs inference on compromised hosts. Datacenter GPUs are an obvious target, but Zhou and Freeman show that a distributed botnet of IoT machines can still host a capable model. In their demo, Gemma4-26B-A4B runs across 15 inexpensive off-brand Android TV boxes (about $55 each) at roughly 0.39 tokens per second, with pipeline parallelism sharding layers across boxes that typically ship with 1–4 GB of RAM.

Home and small-business IoT is attractive because it is online and often weakly secured. Models too large for one gadget can be sharded across fridges, ovens, vacuums, and lawnmowers; security cameras and video-conferencing gear increasingly ship with on-device AI chips, expanding the pool of edge compute. Unlike classic botnets tied to one exploit, Anthropic notes that an AI-driven replicator could figure out unfamiliar devices—and would be hard to shut down because there is no single off switch, though spread may be slow (doubling times on the order of days).

What the lab measured

Anthropic breaks replication into finding targets, gaining execution, standing up inference, and propagating further. Prior work on cyber benchmarks is cited for the first two stages; this study focuses on inference setup—a long, serial chain of OS- and hardware-specific decisions that smaller models often fumble when composed end to end.

Using their Memento agent harness (built on the Pi coding agent), they task models to serve Llama3.1-8B across heterogeneous hardware. In evaluations, a 9B model got inference running on 8 of 9 hardware types tested. Models of 30B parameters and under can already complete many individual replication steps but make mistakes when chaining them.

For full end-to-end spread, the team built a firewalled VPC of 8 GCP nodes running redroid (Android 15 emulators) with unauthenticated ADB—deliberately trivializing the cyber step to approximate an upper bound on success. Worms are tasked to stand up Llama3.1-8B inference (not themselves) for an apples-to-apples comparison across model sizes. The worm’s own model ran on a separate inference server, since the VPC nodes were too small to host it. Only GLM-5.2 among tested open-weight models achieved reliable full replication: 8/8 nodes in 4 of 5 trials and 7/8 in one. In simplified evaluations, GLM-5.2 and stronger models are capable of end-to-end replication; if small models improve at their historical rate, Anthropic estimates they could match that capability level by the end of 2026, with small weight-based replicators possible soon after.

Floor, ceiling, and timing

Anthropic frames two constraints: a capabilities floor (reliable end-to-end replication—GLM-5.2 in their eval) and a size ceiling (what can run on compromised TVs and similar devices—e.g. Qwen3.5-9B and Gemma4-26B-A4B under their RAM assumptions). Today those lines do not intersect: no current model is both small enough for their smart-TV ceiling and strong enough for their replication floor in this framing.

They extrapolate timing with the Epoch Capabilities Index (ECI), plotting open models ≤30B and fitting a trend of about 13.7 ECI per year (R² 0.95). Taking GLM-5.2 as the floor, that trend places a small model at the same level by end of 2026—with the explicit caveat that ECI is only a proxy for replication skill.

Inference setup is slow on edge hardware. Reported full inference setup times span roughly 71–150 hours for Gemma4-26B-A4B and 28–51 hours for Qwen3.5-9B. Using the Kimwolf botnet analogy (more than 2 million devices (primarily Android TV boxes) at peak), Anthropic sketches that if every 15 TVs ran one Gemma4-26B-A4B replica, a fleet that size could host on the order of ~133k replicas—a thought experiment, not a forecast of an active worm.

Adaptation and defenses

On adaptation, Qwen3.5-9B instances that inherit notes across generations saw inference-setup success rise from 45% in generation 1 to 61–84% in later ones. Access to Opus 4.8 as an advisor did not measurably help—small models struggled to ask useful questions even when advice was automatic.

Blue-team ideas from the post include ISP flow anomalies (large weight payloads and device-to-device inference traffic), honeypots to capture harnesses, and quarantine workflows reminiscent of Mirai cleanup (Anthropic cites ~92% clearance in 14 days with ISP notification vs. 74% without). Hardening IoT defaults and regulation—such as making default IoT passwords non-compliant in the UK—shrinks the attack surface for both scripted and AI-driven botnets.

“Signs of life for AI worms”

Anthropic’s conclusion is measured but stark: capabilities that power coding agents also generalize to cyber tasks including replication. As the authors put it, “Like coding agents in 2024, we’re seeing signs of life for AI worms.” They add that they don’t yet have a full rogue replicator, but agents are increasingly completing individual steps in the replication chain—and passing adaptations to daughter copies.

Important caveats to keep in view: cyber exploitation was intentionally easy in the VPC eval; ECI extrapolation is approximate; and Anthropic is not claiming observed wild IoT worms in production. The practical takeaway for security teams is to treat edge AI capacity and weak IoT posture as part of the frontier-risk picture—not a distant datacenter-only problem.