Anthropic Warns Small AI Models Could Soon Replicate Across Everyday Devices

Anthropic has warned that small artificial intelligence models could soon become capable of replicating across everyday internet-connected devices, creating a new category of cybersecurity threat. In research published on October 12, 2026, the company’s Frontier Red Team examined whether AI models could configure themselves to run on unfamiliar hardware and continue spreading between compromised devices. The researchers said that relatively small models can already perform many of the individual steps required for replication, although reliably combining every step remains difficult for most systems.

The research raises concerns about the security of inexpensive connected products, including Android TV boxes, smart appliances, cameras and other Internet of Things (IoT) devices. Unlike conventional malware that depends on a centralized command server, a hypothetical AI-powered worm could carry or retrieve its own model weights and run inference on compromised hardware. Anthropic warned that such a network could be difficult to dismantle because it would not necessarily depend on a single central computer. However, the experiments did not demonstrate a fully autonomous worm spreading through real-world consumer networks. The company is describing a potential near-term risk, not reporting a widespread AI infection already underway.

Key Takeaways

• New cybersecurity warning: Anthropic says small AI models could become capable of replicating across poorly secured consumer devices within months.
• Cheap devices are a potential target: Inexpensive Android TV boxes and other connected devices may offer accessible computing resources.
• Hardware experiment: Researchers distributed a model across 15 off-the-shelf Android TV boxes costing approximately $55 each.
• Small models are improving: A 9-billion-parameter model successfully configured AI inference on eight of nine tested hardware types.
• Full replication remains difficult: Anthropic reported that GLM-5.2 completed the full replication chain in four out of five runs in its simplified evaluation.
• No confirmed real-world AI worm: The experiments did not establish that an autonomous AI worm is already spreading through everyday consumer devices.
• Security implications: Manufacturers, businesses and consumers may need stronger device security, network isolation and monitoring.

What Is an AI Worm?

A computer worm is a type of malware that can spread from one system to another without requiring a person to manually install it on every target. Traditional worms typically exploit software vulnerabilities, weak credentials or poorly configured systems to gain access to additional devices.

An AI worm would add another capability: it could carry an AI model as part of its payload or retrieve the model’s weights from another location, then use the compromised device’s hardware to run the model.

In theory, an AI-enabled worm could use a model to help it adapt to unfamiliar hardware, diagnose installation problems and coordinate multiple steps in the replication process. That could make it more flexible than malware built around a fixed set of instructions.

The distinction is important. An AI model does not automatically spread itself merely because it can generate code or solve problems. Replication requires access to vulnerable systems, the ability to execute actions, sufficient computing resources and a way to transfer or retrieve the model.

Anthropic’s research investigates whether AI capabilities are advancing enough to make this combination increasingly practical.

How Anthropic Tested AI Replication

Anthropic’s Frontier Red Team, which evaluates potential risks from advanced AI systems, examined several parts of the replication process. The researchers focused particularly on whether a model could establish a working AI environment on hardware it had not previously encountered.

For one experiment, the team bought 15 inexpensive Android TV boxes costing about $55 each. Each device had 4GB of RAM. Researchers distributed the Gemma4-26B-A4B model across the devices, allowing different machines to handle portions of the model.

The distributed setup ran at approximately 0.39 tokens per second. That is slow compared with typical AI services, but the experiment demonstrated that inexpensive consumer hardware could collectively support a model that would be difficult to run on a single device with limited memory.

The researchers also examined whether AI models could complete a sequence of tasks required for replication. These included identifying devices, obtaining access, setting up the necessary AI environment and continuing the process on another system.

Importantly, the study largely excluded the initial exploitation stage, drawing on earlier research into AI-assisted cyberattacks. Its focus was whether a model could configure inference on unfamiliar hardware and connect the different stages of replication.

This limitation matters when interpreting the results. Demonstrating that a model can run on a collection of devices is not the same as demonstrating that it can independently compromise those devices and spread through an unprotected network.

Why Small AI Models Are a Particular Concern

The most important finding is that advanced AI capabilities may not require enormous data-center infrastructure to operate.

Small language models can run on less powerful hardware than the largest frontier models. As inference software and hardware improve, some models may become capable enough to perform useful tasks on devices with limited computing resources.

Anthropic’s research found that a 9-billion-parameter model managed to set up an AI inference environment on eight of nine tested hardware types. However, completing individual tasks is different from reliably chaining them together into a successful replication process.

In the team’s simplified evaluations, GLM-5.2 completed the full replication chain across all eight test nodes in four out of five runs. Most other tested models struggled to complete the entire sequence reliably.

Anthropic argues that continued improvements in small models could close this gap. Its researchers estimate that small models may reach the necessary capability level by the end of 2026 if progress continues at its historical rate.

That is a projection based on observed development trends, not a guaranteed deadline. Model capabilities, device security and the practical requirements of a real-world attack could all affect whether the scenario becomes feasible.

Why Smart Devices Could Become Targets

Many consumer IoT devices are designed to be inexpensive, convenient and energy-efficient. Some receive infrequent security updates, use outdated software or provide limited visibility into what is happening on the device.

These characteristics can make poorly maintained products attractive targets for cybercriminals. Examples include inexpensive TV boxes, connected cameras, smart appliances and other devices that remain online for long periods.

An attacker who compromises multiple devices may be able to combine their resources. In a distributed AI setup, different devices could theoretically run portions of a model and communicate with one another.

This would not make every smart appliance a powerful AI computer. The available memory, processor, storage, network speed and power consumption would constrain what each device could do.

The broader concern is that the number of connected devices is large, and security practices vary considerably across manufacturers and product categories. If a sufficiently capable AI system could adapt to different hardware environments, it might be able to use a wider range of compromised devices than a rigid, device-specific program.

The research therefore highlights the importance of securing connected products throughout their operating life, not only during initial setup.

Could an AI Worm Become Difficult to Shut Down?

One of Anthropic’s concerns is the possibility of a distributed replication network without a single central point of failure.

Many conventional malware operations rely on command-and-control infrastructure. Security teams may disrupt such operations by identifying and disabling the relevant servers, domains or communication channels.

A hypothetical AI worm that spreads between devices and runs its model locally could be more distributed. Some devices might continue operating even after other infected systems are removed.

The model could also be divided into portions across multiple machines, potentially allowing devices to share the work of running a larger model. Anthropic’s experiment with distributed inference across TV boxes illustrates one technical approach, although it does not prove that an autonomous worm could deploy this architecture at scale.

Such a network would still have weaknesses. Devices need power, compatible hardware, communication links and sufficient resources. Security teams could disrupt propagation by patching vulnerabilities, isolating affected networks, removing unauthorized software and blocking malicious communications.

The difficulty would depend on how the hypothetical worm spreads, how quickly defenders detect it and how many devices are affected.

How an AI Worm Differs From Traditional Malware

Feature	Traditional computer worm	Hypothetical AI-powered worm
Propagation	Uses programmed procedures and known techniques	Could potentially use AI to adapt parts of the process
Hardware compatibility	Often depends on specific systems or vulnerabilities	Could potentially configure itself for unfamiliar hardware
Computing resources	Usually runs conventional malicious code	Could carry or retrieve model weights and run inference
Adaptability	Depends on its programming and updates	Could use model capabilities to handle unfamiliar situations
Current evidence	Real-world worms are well documented	Anthropic’s proposed AI replication scenario remains a developing risk

The comparison describes potential differences, not a claim that AI worms have already surpassed conventional malware in real-world effectiveness.

AI can also assist defenders. Security teams can use models to analyze logs, identify unusual device behavior, investigate vulnerabilities and automate parts of incident response. The security outcome will depend on how attackers and defenders use these capabilities.

What the Warning Means for Device Manufacturers and Businesses

The research provides a reason for manufacturers to strengthen security across connected products, particularly inexpensive devices that may remain in use for years.

Manufacturers can reduce exposure by delivering security updates, eliminating default passwords, restricting unnecessary network services and limiting the privileges available to software running on a device. Secure boot mechanisms and signed updates can help prevent unauthorized software from persisting.

Businesses can also reduce risk by separating IoT products from sensitive corporate systems. A compromised television or camera should not automatically provide a path into a company’s internal network.

Network monitoring is another important defense. Unusual outbound connections, unexpected software installations and unexplained resource consumption can indicate that a device is behaving differently from its normal operating pattern.

Organizations should also plan how to isolate and restore affected devices. Security teams may need to disconnect a device, identify the source of the compromise, install trusted firmware and verify that the vulnerability has been addressed before reconnecting it.

These measures are useful against conventional IoT malware as well as the more advanced scenario described by Anthropic.

What Consumers Can Do to Reduce the Risk

Consumers do not need to panic or stop using connected appliances because of this study. The research describes a potential future threat, and it does not establish that ordinary household devices are currently being infected by self-replicating AI models.

A few basic security practices can nevertheless reduce exposure:

• Install firmware and security updates when manufacturers provide them.
• Replace devices that no longer receive security support when practical.
• Change default passwords and use strong, unique credentials.
• Disable remote access and network services that are not needed.
• Use a guest or separate network for IoT devices where the router supports it.
• Buy connected products from manufacturers with a clear security-update policy.
• Investigate unusual network activity or unexpected device behavior.

These steps cannot eliminate every cyber risk, but they reduce common weaknesses that attackers may exploit.

The Bigger Picture

Anthropic’s research illustrates how AI could change the economics of cyberattacks. Smaller models may eventually combine reasoning, tool use and hardware adaptation in ways that make complex tasks easier to automate. If those capabilities are paired with vulnerabilities in poorly secured devices, the result could be a new form of distributed malware.

The study does not show that such a threat is already widespread, nor does it establish that every model will become capable of self-replication by a specific date. It demonstrates that some components of the process are becoming technically feasible and argues that manufacturers and security teams should prepare before they are reliably combined in real-world attacks.

Looking Ahead

The next important development will be whether smaller models can reliably complete the full replication process under realistic security conditions. Future research will need to distinguish laboratory demonstrations from real-world feasibility, including how devices are compromised, how models are transferred and how defenders can detect and stop propagation. The results will help establish whether Anthropic’s projected timeline is realistic or whether substantial technical barriers remain.

For device manufacturers and businesses, the practical response is to strengthen existing security rather than wait for a new category of malware to emerge. Better update mechanisms, secure configurations, network segmentation and monitoring can make connected devices harder to compromise. As AI capabilities improve, the effectiveness of these established defenses will become increasingly important in preventing automation from turning individual vulnerabilities into larger incidents.

Frequently Asked Questions

1. What did Anthropic’s study find?

Anthropic found that small AI models can already complete many individual steps needed for autonomous replication, including setting up inference on unfamiliar hardware. Its researchers warned that more capable models could combine these steps within months, although the full real-world scenario has not been demonstrated.

2. What is an AI worm?

An AI worm is a hypothetical form of malware that uses an AI model to help it spread between systems. It could potentially carry model weights or retrieve them and run inference on compromised devices.

3. Did Anthropic demonstrate an AI worm spreading in the real world?

No. The experiments examined parts of the replication process, including distributed model inference on inexpensive TV boxes. They did not demonstrate a fully autonomous AI worm spreading through ordinary consumer networks.

4. Which devices could be at risk?

Poorly secured internet-connected devices could be potential targets, including inexpensive Android TV boxes, cameras, smart appliances and other IoT products. Actual risk depends on vulnerabilities, software updates, permissions and network configuration.

5. Which AI model completed the replication chain in Anthropic’s tests?

Anthropic reported that GLM-5.2 completed the full replication chain across eight test nodes in four out of five runs in its simplified evaluation. This does not mean it has been observed spreading autonomously through real-world devices.

6. Why would AI replication be harder to stop?

A distributed network could run models across many compromised devices instead of relying on a single central server. That could complicate disruption, although patching vulnerabilities, isolating devices and removing malicious software could still help contain it.

7. Can consumers protect their smart devices?

Yes. Installing updates, replacing unsupported devices, changing default passwords, disabling unnecessary remote access and separating IoT devices from sensitive networks can reduce exposure.

8. When could self-replicating AI become possible?

Anthropic estimates that small models may reach the required capability level by the end of 2026 if progress continues at its historical rate. This is a forecast, not a confirmed date for a real-world incident.