Anthropic Warns Small AI Models Could Soon Self-Replicate Across IoT Devices

Small AI models could soon spread across consumer IoT devices and create distributed botnets capable of running AI workloads outside traditional data centers, Anthropic warns.

Anthropic researchers found that AI models can identify unfamiliar devices, connect to them over a network, install the required software, and prepare the devices to run other AI models.

In one experiment, researchers successfully distributed Google DeepMind’s Gemma4-26B-A4B model to 15 off-premises Android TV boxes. However, they did not demonstrate a fully autonomous, self-replicating AI worm operating on real-world IoT hardware.

Despite that limitation, Anthropic estimates that small AI models could achieve self-replication by the end of 2026 if they continue improving at historic rates.

“Our experiments suggest that it may be several more months before small AI models can sufficiently self-replicate on commercial Internet of Things (IoT) devices such as smart ovens or off-brand Android TV boxes,” Anthropic researchers warn.

“Such replicators can be slower (double the number of days) because there is no central point to shut them down, but they are difficult to shut down.”

Anthropic’s AI self-replication experiment

Anthropic ran a replication experiment using an inexpensive Android TV box and several AI models, each assigned a different role: Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8, and GLM-5.2.

Qwen3.5-9B and GLM-5.2 acted as agents tasked with setting up and propagating Llama3.1-8B for inference. Gemma4-26B-A4B demonstrated that the model could run across 15 Android TV boxes, while Opus 4.8 was independently tested as an advisor for Qwen.

For the experiments, Anthropic used a simplified configuration in which the target device exposed unauthenticated ADB access.

Qwen3.5-9B successfully installed and configured the necessary software to run Llama3.1-8B on eight of the nine hardware types tested.

GLM-5.2 reached all eight nodes in the controlled, emulated network in four out of five trials. The other models were unable to reliably complete the full process.

Anthropic also found that retaining data from previous attempts improved success rates. Qwen3.5-9B’s success rate increased from 45% in earlier generations to 84% in later generations.

Using the more powerful Opus 4.8 model to aid Qwen’s inference did not produce any visible improvement.

AI worms could become faster and harder to contain

Based on these results and historical data, Anthropic predicts that models with fewer than 30 billion parameters could reach the required level of functionality by the end of 2026.

On the tested hardware, setting up inference took between 28 and 51 hours for Qwen3.5-9B and between 71 and 150 hours for Gemma4-26B-A4B. That leaves defenders enough time to detect the activity and respond.

However, future models could reduce the time required to compromise and configure devices. As a result, stronger security measures for consumer IoT devices may soon become a priority.

How defenders can detect self-replicating AI threats

Anthropic suggests several defensive measures for identifying and containing this type of activity:

• Detecting large AI model transfers.
• Monitoring anomalous device-to-device traffic.
• Using honeypots to inspect suspicious payloads.
• Isolating infected subscribers.
• Improving IoT security defaults.

Anthropic’s warning is not based on an immediate threat. The experiment did not demonstrate full end-to-end worm creation, even with lower security settings and explicit propagation goals.

Nevertheless, the findings highlight the need for better IoT security before smaller AI models become faster, more capable, and able to spread across poorly secured consumer devices.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat