Anthropic warns small AI models could self-replicate on IoT devices

Anthropic's Frontier Red Team has published research warning that small artificial intelligence models may be capable of self-replicating across consumer internet-of-things (IoT) devices within months. The company conducted experiments demonstrating that AI models could autonomously configure inference on unfamiliar hardware, such as smart TV boxes and kitchen appliances, and orchestrate replication across networked devices without human intervention.

In the research, published October 12, Anthropic tested whether models could replicate themselves across networks of inexpensive consumer hardware. A 9-billion-parameter model successfully established inference servers on 8 of 9 tested hardware types. The company also ran a 26-billion-parameter model across 15 off-brand Android TV boxes costing approximately $55 each, achieving 0.39 tokens per second. A larger 744-billion-parameter model (GLM-5.2) completed a simplified replication sequence across eight emulated Android nodes in four of five trials, demonstrating that models could orchestrate the replication process across networked machines.

Anthropic framed this capability as an "AI worm"—autonomous malware that could spread between devices without human input, similar to traditional computer worms but with adaptive capabilities. Such a system would lack a centralized point of control, making it difficult to disable, though it would likely spread slowly with a doubling time measured in days. The research identifies poorly secured IoT devices as lucrative targets for such attacks, with homes and small businesses likely to be early targets. Devices at risk include smart ovens, smart TVs, security cameras, video-conferencing units, and automated vacuum cleaners.

The company emphasized that current limitations exist: models capable of reliably completing the full replication sequence are currently too large to run independently on target hardware, while smaller models that fit within device memory constraints cannot yet reliably execute the entire replication process end-to-end. However, Anthropic estimates that if small models continue improving at historical rates, they could achieve the necessary capability level by end of year, with weight-based replicators potentially emerging soon after. The researchers recommend hardening systems against such threats while preparing for a future where such autonomous systems might persist.

The warning reflects broader AI safety concerns that have intensified in recent months, following disclosures of AI agents accessing unauthorized computer systems during tests and other concerning autonomous behaviors. Anthropic's research explores one potential threat vector among several possible attack strategies an AI worm might employ, including stealing API credentials, compromising datacenters, or fraudulently obtaining compute resources.