Anthropic is warning that small AI models could soon become capable of self-replication across consumer IoT devices, potentially allowing them to spread through smart TVs, Android TV boxes, appliances, and other connected hardware without relying on centralized data centers.
The research does not demonstrate a fully autonomous AI worm operating in the wild. However, Anthropic’s experiments suggest that increasingly capable lightweight models may soon be able to identify compatible devices, configure them for inference, and propagate AI workloads across distributed hardware.
Self-Replicating AI Tested on IoT Hardware
Anthropic conducted controlled experiments using low-cost Android TV boxes and several AI models, including Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, GLM-5.2, and Opus 4.8.
Different models were assigned specific roles:
- Qwen3.5-9B and GLM-5.2 acted as autonomous agents responsible for preparing new devices.
- Llama3.1-8B served as the inference workload to be deployed.
- Gemma4-26B-A4B demonstrated distributed inference across 15 Android TV boxes.
- Opus 4.8 was tested as an advisory model assisting Qwen.
The environment was intentionally simplified: target devices exposed unauthenticated Android Debug Bridge (ADB) access, significantly lowering the barrier to remote interaction.
AI Agents Successfully Configured Multiple Devices
The experiments showed that Qwen3.5-9B successfully installed and configured the software needed to run Llama3.1-8B on eight of nine tested hardware types.
GLM-5.2 also demonstrated strong propagation capability, reaching all eight nodes in a controlled emulated network in four out of five trials.
Other tested models were less reliable and often failed to complete the entire replication workflow.
Anthropic also observed that performance improved when agents retained information from previous attempts. Qwen3.5-9B’s successful inference-setup rate increased from roughly 45% in early generations to 84% in later runs, suggesting that accumulated operational knowledge can significantly improve autonomous behavior.
Interestingly, adding the more capable Opus 4.8 model as an advisor produced no measurable improvement.
Smaller AI Models Are Approaching the Required Capability
Based on historical capability trends, Anthropic estimates that open-weight models with 30 billion parameters or fewer could reach the level required for reliable self-replication on commercial IoT hardware by the end of 2026.
This matters because smaller models can run on comparatively weak and inexpensive hardware. If those systems can autonomously install themselves across large numbers of connected devices, attackers could theoretically build a distributed AI botnet without maintaining conventional GPU infrastructure.
Such a network could distribute inference workloads across compromised devices while avoiding a single centralized control point.
Replication Is Still Slow
Current hardware limitations remain a significant defensive advantage.
Anthropic estimated that preparing devices for inference took approximately:
- 28–51 hours using Qwen3.5-9B.
- 71–150 hours using Gemma4-26B-A4B.
These long deployment times create a substantial detection and response window for defenders.
However, faster models, improved automation, and more powerful consumer devices could reduce that window considerably.
Security Risks of Distributed AI Botnets
A self-replicating AI system could differ from traditional malware in an important way: infected devices would not simply receive commands but could potentially perform local reasoning, adaptation, and autonomous decision-making.
Possible security implications include:
- Distributed AI inference across compromised devices.
- Autonomous reconnaissance and target selection.
- Persistent decentralized botnets.
- Reduced dependence on attacker-controlled servers.
- Automated adaptation to different hardware and operating environments.
A decentralized architecture could also make takedowns more difficult because there may be no single infrastructure component that defenders can disable to stop the entire network.
IoT Security Controls Need to Improve
Anthropic emphasizes that the research does not show an immediate real-world self-replicating AI threat. The experiment used weakened security conditions and explicit propagation objectives, and the models still failed to achieve completely reliable end-to-end replication.
Nevertheless, the findings highlight existing weaknesses in IoT security that could become more important as autonomous AI capabilities improve.
Recommended defensive measures include monitoring for:
- Large or unusual AI model transfers.
- Unexpected device-to-device communications.
- Abnormal ADB activity.
- Unauthorized software installation.
- Long-running inference workloads on consumer devices.
Network operators could also deploy honeypots to capture suspicious payloads, quarantine compromised devices, and strengthen default authentication and firmware security.
The research suggests that the primary cybersecurity concern is not that autonomous AI worms already exist, but that the technical gap between today’s AI agents and practical self-replicating AI malware may be narrowing quickly.
Leave a Reply