Anthropic warns small AI models could soon self-replicate on IoT devices

What Anthropic Found

AI company Anthropic has warned that small artificial intelligence models may soon be able to self-replicate across networks of Internet of Things (IoT) devices, such as smart TVs and other connected gadgets. Their research shows that these models are close to being able to spread themselves autonomously, much like a computer worm, but with the ability to adapt to unfamiliar devices. The findings were published after experiments using off-brand Android TV boxes, which showed that even cheap, low-powered hardware could run these models and potentially be used as a launchpad for self-replicating malware Ars Technica↗ (opens in a new tab), SecurityWeek↗ (opens in a new tab), Security Affairs↗ (opens in a new tab).

How the Experiments Worked

Anthropic's team tested several open-weight AI models, including Gemma4-26B-A4B and Qwen3.5-9B, on a network of 15 Android TV boxes. These devices, each with only 4GB of memory, were able to collectively run the AI model, though slowly. The researchers broke the replication process into four steps: finding targets, gaining access, setting up the AI model on a new device, and repeating the process. While only the largest tested model (GLM-5.2) could reliably complete the full cycle, smaller models were able to handle most individual steps. The team predicts that if small models continue to improve at their current rate, they could achieve full self-replication in the near future.

Why This Is Different from Traditional Malware

Traditional IoT malware, like the Mirai botnet, spreads by exploiting known vulnerabilities or default passwords and is usually limited to specific device types. In contrast, an AI-powered worm could adapt itself to new hardware and software environments, making it much harder to stop. Anthropic calls these potential threats "small weight-based replicators" because the AI model's weights (the data that defines the model) become part of the malware payload. These replicators could learn from failed attempts, passing notes and code to future copies, and adjust their approach as they spread.

The Current Limitations and Future Risks

Right now, small models are slow and still make mistakes when trying to replicate end-to-end. For example, the Gemma4-26B-A4B model took up to 150 hours to set up on the test devices. However, the pace of improvement is rapid. Anthropic notes that the "floor" for reliable autonomous replication (the minimum capability needed) and the "ceiling" (the largest model that fits on cheap devices) are getting closer. Once they overlap, small AI models could become a practical tool for attackers to build adaptive, hard-to-remove botnets.

What Defenders and Manufacturers Can Do

Defending against this kind of threat will require both technical and policy changes. Network anomaly detection, such as monitoring for unusual traffic between devices, was effective against past botnets and could help spot AI-based worms. Quarantining infected devices and guiding users through cleanup can also work, as shown in previous campaigns. However, the real solution lies in reducing the pool of vulnerable devices. This means enforcing stronger default passwords, requiring regular firmware updates, and tightening IoT security standards. The UK has already banned default passwords on IoT devices, and more countries may follow suit Security Affairs↗ (opens in a new tab).

What Happens Next

Anthropic's research is a warning, not evidence of an active threat. No public exploitation of these techniques has been reported yet CISA↗ (opens in a new tab). But as AI models get smaller and smarter, the risk of self-replicating AI malware on consumer devices is moving from theory to possibility. Security teams, manufacturers, and regulators will need to act before attackers do.