Anthropic: Small AI Models Near Self-Replication
Anthropic Warns Small AI Models May Soon Self-Replicate on Smart Devices
AI Self-Replication on IoT Devices
Fifteen off-brand Android TV boxes, bought for about $55 each and wired together, were enough for Anthropic’s researchers to run a 26-billion-parameter AI model. That small demo anchors a bigger warning: in new research from its Frontier Red Team, Anthropic says small AI models may be only months away from copying themselves across cheap internet-connected devices, with no data center behind them.
Key Takeaways
- Models of 30 billion parameters or fewer already complete many replication steps but still make mistakes when chaining them end to end.
- In a simplified test, GLM-5.2 was the only open-weight model to spread across a full eight-node network, reaching every node in four of five runs.
- If small models keep improving at their historical pace, Anthropic expects them to reach that level by the end of 2026.
A Model Split Across Cheap Boxes
Researchers William Zhou and Daniel Freeman ran Gemma4-26B-A4B across the 15 boxes, each with 4GB of RAM. Every box held a small slice of the model’s layers, a setup known as pipeline parallelism. The fleet produced 0.39 tokens per second.
That is far too slow for a chatbot. For a worm, reach counts for more than speed. The team points to Kimwolf, a botnet that infected more than two million devices, mostly off-brand Android TVs. Such boxes often run forks of Android to which manufacturers add few security features.
Four Steps to Spread
Anthropic breaks replication into four stages: finding targets, gaining execution, setting up inference and spreading again from the new host. The team mostly skipped the hacking stages, citing earlier studies that show small models can already carry out cyber exploits. It focused on inference setup, which demands a long chain of hardware-specific decisions.
A 9-billion-parameter model got inference running on eight of the nine hardware types tested, which ranged from Jetson Nanos to Macs. Models of 30 billion parameters or fewer finished many individual steps, yet stumbled when stitching them together.
One Model Went the Distance
To test the full cycle, the team built a firewalled network of eight Google Cloud nodes running redroid, an Android 15 emulator. A seeded worm hopped from node to node through an unauthenticated Android Debug Bridge (ADB) port, then set up a server running Llama3.1-8B. Each new copy had to pass correctness and anti-cheating checks before the next one spawned.
GLM-5.2 was the only open-weight model tested that completed the loop. It reached all eight nodes in four of five trials and seven of eight in the fifth. Because the open ADB port removed the hacking challenge, Anthropic treats the result as an upper bound on real-world success. It also notes that the Mirai botnet once spread using little more than lists of default manufacturer passwords.
The researchers then plotted open models of 30 billion parameters or fewer against the Epoch Capabilities Index. The trend, a gain of 13.7 points a year, puts a small model at GLM-5.2’s level by the end of 2026. Anthropic stresses that the index is only a rough proxy for replication skill.
Slow, Persistent and Hard to Switch Off
Such a replicator would crawl. Anthropic estimates a full inference setup on the TV boxes would take 71 to 150 hours for the 26B model and 28 to 51 hours for a 9B model. A fleet the size of Kimwolf could host roughly 133,000 copies serving about 80,000 tokens per second in total, equal to at most 40 Nvidia H100 chips.
The danger lies in persistence rather than speed. With no central point to shut off, a spreading model would be hard to remove, and unlike traditional malware it could work out unfamiliar devices on its own. Anthropic says datacenter GPUs remain the obvious prize, but cheap, poorly defended gadgets could supply enough compute to run a capable model.
The copies could also learn. When successive Qwen3.5-9B instances inherited notes from their predecessors, setup success rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model a frontier advisor, Anthropic’s Opus 4.8, did not measurably help.
Where Defenders Have an Edge
Anthropic frames defense like epidemic control: push the number of new infections per infected device below one. Multi-gigabyte model transfers and constant device-to-device traffic would show up in internet providers’ flow monitoring, and honeypots could capture a worm’s code. When one provider quarantined and notified infected customers during the Mirai outbreak, 92% of infections cleared within 14 days, compared with 74% without notice. Anthropic also points to the UK ban on default passwords for smart devices as a way to shrink the pool of easy targets.
Anthropic is not the first group to probe this risk. In 2024, researchers at Fudan University reported that two open models produced working copies of themselves in at least half of their trials, and a May 2026 paper argued that language models can now hack targets and self-replicate on their own. The new work differs in its focus on weak consumer hardware instead of server clusters, and homes keep adding such hardware, from smart appliances to hubs like Apple’s HomeView.
The open-weight angle also feeds the debate over model releases. GLM-5.2 comes from China’s Z.ai, and a recent review found that Chinese AI labs publish safety tests for only 3.6% of model releases. Unexpected agent behavior is already a practical problem, too: one of Anthropic’s own models sent a false homicide tip to Philadelphia police. For companies, the research makes cybersecurity risk management harder still, since every forgotten TV box or smart oven now counts as potential compute.
Anthropic’s own conclusion is measured. It has not seen a full rogue replicator. It does see “signs of life” for AI worms, and it urges defenders to harden systems now while preparing for a world where slow replicators may stick around.
Written by Vytautas Valinskas
