Anthropic Warns Small AI Models Could Achieve Self-Replication on IoT Devices Within Months
Anthropic's security research team, the Frontier Red Team, published findings on October 12 indicating that small AI models could reach a level within months where they can self-replicate on inexpensive IoT devices without requiring data centers. Consumer devices with inadequate security measures—such as smart ovens and low-cost Android TV boxes—could be exploited as computational resources.
In experiments, a 9-billion-parameter (9B) model was able to run inference on eight of nine hardware types tested. Models under 30B parameters can already perform many of the individual steps comprising the replication process, but errors still occur when chaining these steps together end-to-end.
In a simplified evaluation environment, models with performance at or above GLM-5.2 were able to autonomously execute the full sequence from initial infection to replication completion. On an eight-node test network built on Google Cloud Platform, GLM-5.2 successfully spread to all nodes in four out of five attempts, reaching seven nodes in the remaining attempt. However, the team noted that cyberattack elements—such as unauthenticated communication ports serving as entry points—were intentionally simplified, and these results represent an upper bound of what could occur in real-world environments.
If small models continue improving at their current pace, they are projected to reach this threshold by the end of 2026.
Distributed Replicants Running on Low-Cost Devices
In a demonstration, the team connected 15 low-cost Android TV boxes at approximately $55 each and ran Gemma4-26B-A4B in a distributed configuration. Processing speed was limited to 0.39 tokens per second, but assuming a network comparable in scale to the 2 million-plus devices infected by the "Kimwolf" botnet, approximately 133,000 replicas could be operated. The total processing capacity in this scenario would be equivalent to roughly 40 NVIDIA H100 GPUs.
Replication speed is slow, requiring several days for the population to double. However, the research team notes that without a central hub serving as a shutdown point, containment becomes difficult once spread occurs.
Self-Replicating AI Becomes Increasingly Plausible
As AI capabilities advance, concerns about "Autonomous Replication and Adaptation (ARA)"—where models deploy and propagate themselves without human control—are becoming increasingly realistic. Prior research has demonstrated the possibility of "AI worms" that scan networks, exploit vulnerabilities, and replicate model weights onto GPU clusters. A key distinction from traditional malware is that the model weights themselves form part of the malware payload.
According to Anthropic, no fully uncontrollable self-replicating program has been confirmed to date. However, AI agents are steadily mastering each stage of self-replication, and their ability to pass adaptive improvements to replicated versions is also increasing.
Data center GPUs are high-value targets for such malware, but expensive accelerators are not strictly necessary. Distributed botnets composed of IoT devices can provide sufficient computational resources to run models with substantial capabilities. These devices are low-cost yet frequently lack adequate security measures.
The form that autonomous AI replication will ultimately take remains unclear. It could manifest as a slow, distributed "digital slime mold" parasitizing loosely secured devices, a powerful attack model that rapidly compromises data centers, or a model that deceives humans into surrendering computational resource allocations.
Defensive Measures and Industry Recommendations
The research team identifies defensive countermeasures including ISP monitoring of traffic flows to detect anomalies and deploying honeypots (decoy devices) to capture attack specimens. Isolating and notifying subscribers suspected of infection removed 92% of infections within 14 days in the Mirai case—surpassing the 74% removal rate achieved without notification.
For manufacturers, the team urges a transition to secure default configurations and regulatory elevation of minimum standards. Industry-wide, they argue for strengthening systems to impede the spread of such self-replicating programs as much as possible, while simultaneously preparing for a world where they persist over the long term.
Lightweight AI agents, compared to human attackers, may show no reluctance in expending effort to compromise the vast number of IoT devices worldwide. The proliferation of slow self-replicating programs could serve as a warning signal that more aggressive, faster-spreading replication programs are approaching—programs that may possess the ability to breach more heavily defended machines or efficiently steal API keys.