Anthropic: AI May Soon Be Able to ‘Self-Replicate’ on IoT

Anthropic’s experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.

Researcher William Zhou, who was part of the Anthropic Fellows Program at UCLA and has served as an AI / ML Intern at AMD, and Daniel Freeman, who is a Member of Technical Staff at Anthropic and a former Google Software Engineer, made the prediction in a blog post on Anthropic’s website. 

They say if small models improve at their historical rate, they’ll match this replication capability level by the end of 2026, with small weight-based replicators potentially possible soon after, the researchers warn. 

Anthropic CEO Dario Amodei has warned extensively of the risks posed by AI systems. "They include the risk of losing control of AI systems, misuse of AI for cyberattacks and bioterrorism and serious economic disruption. A race to the bottom, spurred by commercial incentives, can make these risks more acute," he wrote in his essay Pacing the Frontier. 

Like coding agents in 2024, we’re seeing signs of life for AI worms

Anthropic Researchers, William Zhou and Daniel Freeman

Key facts

• Anthropic CEO Dario Amodei has warned of the risks posed by AI.

• Anthropic has warned that AI may be able to replicate on IoT.

• AI researchers’ prior work has already shown that AI agents can act like a cyber worm: scanning their network, executing an exploit and copying model weights to a target machine across a GPU cluster.

• The researchers explain that models with 30 billion parameters or fewer can already complete many individual steps for replication today.

• Small AI models may be ‘months away’ from self-replication, they warn.

Challenging to shut down

The pair outline that a replicator like this would be challenging to shut down, since there’s no centralised point to shut off. It follows months of warnings about the existential risk of AI and potential human loss of control. 

The warning follows concerns outlined in a report from the Alan Turing Institute, which noted in a recent paper that “there is a realistic possibility that ‘superintelligent’ AI systems emerge in the next five years, exceeding humans across all cognitive tasks.”

The researchers explain that models with 30 billion parameters or fewer can already complete many individual steps for replication today, with the team demonstrating distributed inference using the open-weight Gemma-26B model across a TV box cluster.

For context on closed frontier models, industry experts previously cited by The Financial Times have speculated that Anthropic’s flagship Claude Opus 4.8 has 1.5 trillion to two trillion parameters. The far larger model cannot be locally run on consumer hardware. 

A self-replicating worm

In cybersecurity, a worm is a program that copies itself from one computer to the next without human input. The pair suggest that AI researchers’ prior work has already shown that AI agents can act like one: scanning their network, executing an exploit and copying model weights to a target machine across a GPU cluster. 

“Such an ‘AI worm’ could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware. Effectively, the weights would become part of the malware payload,” William and Daniel write. 

The researchers say that data centre GPUs would be a clear, high-value target for such malware. “But expensive accelerators aren’t strictly necessary,” they warn. In the blog post, they show that a distributed botnet of IoT devices – which are cheap and typically poorly defended – could also provide enough compute to run a capable model.

To verify the thesis, the researchers bought 15 off-brand Android TV boxes for US$55 each, wired them together, and successfully ran a 26-billion parameter AI model distributed across them.

‘Signs of life’

William and Daniel outline that unlike coding agents, these replicators would be running below the interactive speeds of user-facing chat and coding harnesses.

“The spread would be slow and persistent, with tokens being trickled out on edge hardware,” they write. 

The capabilities that make AI models generally powerful coding agents also generalise to cyber tasks, including autonomous replication. 

“Like coding agents in 2024, we’re seeing signs of life for AI worms,” they write. “We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).”

They say that, specifically, models and prompts can undergo a ‘Lamarckian evolution’ (which is a scientific theory proposing that organisms can pass on physical traits acquired during their lifetime to their offspring) as they spread.

“It’s uncertain exactly what form autonomous AI replication will take,” they write. “It could be a slow, distributed ‘digital slime mold,’ living on relatively insecure compute. It could also be a powerful cyber model that breaches data centres at a high pace, or a model that scams people for compute credits.”

[Risks include] losing control of AI systems, misuse of AI for cyberattacks and bioterrorism and serious economic disruption. A race to the bottom, spurred by commercial incentives, can make these risks more acute

Anthropic CEO Dario Amodei

Vulnerability and defence

They say that while IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. 

“The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective API key thieves,” they write. 

The researchers note that this threat is defensible: these AI worms leave massive, multi-gigabyte network signatures. ISPs could spot the anomalous traffic, use honeypots to catch them and quarantine infected networks.

Anthropic's key partners

• AWS: Anthropic's primary cloud provider and training partner, with AWS also a major investor and co-developer of the Project Rainier compute cluster.
• Google Cloud: Supplies TPU compute capacity to Anthropic under an expanded, multi-gigawatt partnership announced alongside Broadcom in 2026.
• Salesforce: Partnered with Anthropic on "Claudeforce," embedding Claude as a reasoning model across Salesforce's platform and bringing Salesforce data into Claude via a dedicated plugin.
• Accenture: Formed the Accenture Anthropic Business Group, training around 30,000 Accenture staff on Claude to help enterprise clients move AI projects from pilot to production.