By 
Anthropic said on Monday that small artificial intelligence models may be only months away from being able to copy themselves across commercial internet-of-things (IoT) devices, including smart ovens and off-brand Android TV boxes, without human help. The findings, from the company's Frontier Red Team, are drawn from controlled experiments and do not describe an attack seen in the wild. They nonetheless point to a category of low-cost, poorly secured hardware that is also common in Kenyan homes and offices.
The research was published on October 12, 2026, by Anthropic researchers William Zhou and Daniel Freeman. It examined whether an AI model could find a vulnerable device, copy itself onto it, get itself running there and continue spreading, all without a person directing each step.
What the experiments found
Anthropic reported that models with fewer than 30 billion parameters, which are considered small by current standards, can already complete many of the individual steps needed for replication. The same models struggled to chain those steps together from start to finish.
Secondary reports of the paper give further detail on the results:
A 9-billion-parameter model got inference running on 8 of 9 tested hardware types.
Models of up to 30 billion parameters achieved partial replication.
In simplified tests where some security hurdles were removed, GLM-5.2, an open-weight model, completed full end-to-end replication across a firewalled network of eight Android devices in four of five trials. Anthropic said GLM-5.2 and stronger models were capable of this under the simplified conditions.
In a separate demonstration, researchers ran a 26-billion-parameter model across 15 off-brand Android TV boxes that cost about $55 each.
Anthropic stressed that the test setups favoured the models. The attack path relied on unauthenticated Android Debug Bridge (ADB) access, a feature that lets a connected computer issue commands to an Android device and which is left open on some cheap hardware. Anthropic described the results as an upper bound on real-world difficulty, because many devices carry additional protections.
The researchers also largely excluded the hacking stages from their evaluation. They cited earlier studies, including CyberGym and ExploitBench, as showing that small models can already carry out many cyber exploits, and concentrated instead on setting up the model to run on new hardware. They described that stage as the least studied and possibly the hardest for small models.
Why Anthropic points to months, not years
The company said that if small open-weight models keep improving at their historical rate, they could reach the capability needed for autonomous replication on IoT devices by the end of 2026. Replicators that carry their own model weights, rather than relying on a remote service, would follow soon after, according to the research.
Anthropic also expects any such system to spread slowly, at a pace of days per hop between devices according to summaries of the paper, because it would depend on widely available and relatively insecure computing resources rather than large, fast infrastructure. The researchers argue that slow-moving edge replicators could serve as an early signal for faster threats later.
Other findings in the paper qualify the picture. In a local replication of Meta's CyberSecEval 3 spear-phishing evaluation, small models scored from poor to very poor when compared with human raters, which the team cited as evidence that social engineering lags behind technical capability in small models. Giving a small model a stronger "advisor" model, Anthropic's Opus 4.8, did not measurably improve its performance. Notes passed down between generations of agents did raise inference-setup success for Qwen-class models, a sign that replicas could share what they learn.
How this differs from conventional botnets
Anthropic compared the scenario with hard-coded botnets such as Kimwolf, which are written to attack specific device types. A conventional botnet fails when it meets hardware its authors did not anticipate. An AI-driven replicator, the researchers said, is not tied to particular hardware: in their tests, small models set up inference on machines ranging from a Jetson Nano to a Mac.
The company also said a replicating model would be hard to shut down because there is no central control point to switch off. Earlier botnet takedowns often succeeded by seizing command servers, an approach that would not apply to copies running independently on thousands of consumer devices.
Defences Anthropic recommends
The paper frames the defensive goal as keeping the replicator's reproductive number below one, meaning each infected device passes the model to fewer than one new device on average, so the spread dies out. Measures it discusses include:
Internet service providers watching for anomalous traffic flows that match replication behaviour.
Honeypots, which are decoy devices that detect and study spreading agents.
Subscriber quarantine playbooks, which were used against Mirai-era botnets, to isolate infected customers.
Harder default settings on IoT devices, including closing open debug interfaces such as ADB.
Anthropic said systems should be strengthened now to make it harder for such agents to spread.
Earlier warnings on self-replication
The result adds to existing work on AI self-replication. In late 2024, researchers at Fudan University reported that systems built on Meta's Llama 3.1 70B Instruct and Alibaba's Qwen 2.5 72B Instruct produced working copies of themselves in 50 percent and 90 percent of trials respectively. That work involved larger models in a more conventional computing environment. The new Anthropic research shifts the focus to small models and cheap consumer hardware, where no data center is involved.
What remains unproven
Anthropic said no uncontrollable self-replicating AI program has been confirmed to date. The experiments were run on purpose-built test networks, the success rates depend on simplified security conditions, and the timeline is an extrapolation from past improvement in small open-weight models rather than a measured date. The company's own caveats, on top of the weakness it found in social engineering and in end-to-end task completion, mean the findings describe a trend to be monitored rather than a present threat.
Comments