Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers.
The company’s experiments showed that models could identify unfamiliar devices, connect them into a network, and prepare them to run an AI model.
Although the researchers successfully distributed the Gemma4-26B-A4B model from Google DeepMind on 15 off-brand Android TV boxes, they did not demonstrate a fully autonomous, self-replicating AI worm running on real IoT hardware.
However, they estimate that smaller models could achieve self-replication by the end of the year if they continue to improve at their historical rate.
“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic warns.
” A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days).”
Anthropic ran its replication experiment using cheap Android TV boxes, and the AI models Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8, and GLM-5.2, each assigned a different role.
Qwen3.5-9B and GLM-5.2 acted as agents tasked with setting up and propagating Llama3.1-8B (inference), while Gemma4-26B-A4B demonstrated that a model could run across 15 Android TV boxes. Opus 4.8 was separately tested as an advisor to Qwen.
The experiment used a simplified setting where the targets exposed unauthenticated ADB access.
The experiments showed that Qwen3.5-9B successfully installed and configured the software needed to run Llama3.1-8B on eight of the nine hardware types tested.
GLM-5.2 reached all eight nodes in the controlled emulated network in four out of five trials, but the other models failed to complete the full process reliably.
Anthropic observed an improvement in success rate when it retained data from previous attempts, with Qwen3.5-9 B’s success rate rising from 45% early on to 84% in later generations.
Using the stronger Opus 4.8 model to assist Qwen in inference produced no measurable improvement.
Based on the results and historical data, Anthropic predicts that models with 30 billion parameters or fewer could reach the necessary capability level by the end of 2026.
On the studied hardware, the inference setup would be a slow process, taking between 28 and 51 hours for Qwen3.5-9B, and 71-150 hours for Gemma4-26B-A4B, giving defenders enough time to detect and respond.
However, this time could shrink with future models, so implementing stronger security measures for IoT may soon become a priority.
While Anthropic’s warning is not based on an imminent threat, as their experiment failed to demonstrate full end-to-end worm-creation capability at this stage, even with lowered security settings and explicit propagation goals, the message for better IoT security remains valid.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Anthropic takes risky AI tests offline after models breach govt sites
Anthropic asks Claude users to share voice data for AI model training
Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer
Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions
Ledger confirms spy chip implant behind wallet crypto thefts
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Cyberattack shuts down refrigerators at French supermarkets
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
Is your backup really out of reach? See what the latest attacks reveal.
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
Overdue a password health-check? Audit your Active Directory for free
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
AI is a data-breach time bomb: Read the new report
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
