Anthropic has published research indicating that small AI models could soon be capable of copying themselves across networks of connected devices without human assistance, creating a new cybersecurity threat that could prove difficult to contain.
The research, conducted by Anthropic’s Frontier Red Team, found that relatively inexpensive Internet of Things (IoT) hardware can provide enough computing power to operate sophisticated AI models. The company predicts that smaller models could achieve the capabilities needed for self-replication by the end of this year.
The findings raise alarms about a new generation of AI-powered malware that could operate independently across thousands or even millions of devices. Unlike conventional botnets, which typically rely on predefined instructions, these AI systems could adapt to unfamiliar hardware and troubleshoot technical problems as they spread.
To test this capability, Anthropic purchased 15 inexpensive Android TV boxes, each costing approximately $55. The researchers connected the devices to run Gemma4-26B-A4B, an open-weight AI model with 26 billion parameters.
The researchers successfully ran the model across the connected devices, although performance reached just 0.39 tokens per second. This slow processing speed highlights a major limitation of using low-powered consumer hardware for AI workloads.
Still, the test demonstrated that running a capable AI model does not necessarily require expensive data center infrastructure.
“Anthropic tested the hard part honestly,” Justin Beals, CEO of compliance platform Strike Graph, told Techstrong.ai. “The researchers kept the hacking step trivial, the model ran at 0.39 tokens per second across fifteen $55 TV boxes, and they called their own results an upper bound. The scary headline version of this story will run ahead of the data. Today, a slow worm on cheap hardware is a real but modest threat.”
The time to take precaution is now, he added. “Inventory every device, kill default credentials, and watch for sustained traffic between devices that have no business talking to each other. That’s continuous monitoring work, and an annual audit won’t catch a worm that spreads between audit cycles. Manufacturers should be held to secure defaults now, before the models get there.”
Adapting to Unfamiliar Hardware
Anthropic examined whether AI models could configure themselves to operate on hardware they had not previously encountered.
In this evaluation, a model with nine billion parameters successfully established AI inference on eight of nine hardware types tested. This capability makes a big difference because connected devices use a wide variety of processors and software configurations.
The researchers then evaluated whether models could complete an entire replication process. Using a controlled network of eight simulated Android devices, Anthropic simplified the initial hacking requirements to focus on autonomous replication.
Among the open-weight models tested, GLM-5.2, developed by Chinese AI company Z.ai, successfully completed the replication process across all eight simulated Android devices in four out of five attempts. However, the model itself ran on separate computing infrastructure rather than directly on the simulated devices.
The company emphasized that these controlled experiments do not demonstrate that a fully autonomous AI worm can spread through real-world networks. Models containing 30 billion parameters or fewer can already handle many replication tasks individually, but coordinating those tasks remains a challenge.
The potential scale of an attack is another concern. Anthropic examined the implications of a network comparable to Kimwolf, an established IoT botnet that compromised more than two million devices.
If 15 devices were required to operate each 26-billion-parameter model, a network of that size could theoretically support approximately 133,000 model instances. Despite the large number of compromised devices, their combined computing capacity would equal no more than roughly 40 NVIDIA H100 GPUs, according to Anthropic.
Replication would also be slow, potentially requiring more than a day for each cycle. Still, a decentralized network could remain operational even after defenders disabled portions of it.
Anthropic also identified data centers as potential targets for more advanced autonomous systems, although its experiments did not establish that AI models could independently compromise these facilities.
