Anthropic Says Small AI Models Are Months From Self-Replicating on Home Devices
AI models small enough to run on cheap smart-home hardware could gain the ability to copy themselves across vulnerable internet-connected devices within months, according to new research from Anthropic — a scenario the company says would leave no central kill switch for defenders to pull.
In a report published Monday, the AI developer said its Frontier Red Team found that models with fewer than 30 billion parameters can already complete many of the individual steps required for self-replication, even if they still struggle to string the entire sequence together end to end. The work focused on commercial internet-of-things equipment — smart ovens, off-brand Android TV boxes, connected appliances — precisely because such devices are ubiquitous, always online, and frequently shipped with weak or nonexistent security.
The findings mark the latest in a series of safety warnings from frontier AI labs about autonomous replication and adaptation, the process by which a model deploys and propagates itself without human oversight. Anthropic was careful to say that a "fully rogue replicator" does not yet exist, but argued that the trajectory of smaller models points toward that capability arriving sooner than many expect.
What the experiments showed
Anthropic ran two parallel strands of research. The first tested whether compact models could stand up inference servers on unfamiliar hardware. Qwen3.5-9B, a 9-billion-parameter open-weight model, successfully configured inference on eight of nine hardware types thrown at it, spanning NVIDIA Jetson Nano boards, Apple Silicon Macs, Xeon servers, a Google TPU, an AMD MI300X, and a PC with an RTX 4090.
The team also purchased 15 generic Android TV boxes at roughly $55 apiece and distributed a single Gemma4-26B-A4B model across them using pipeline parallelism. Each box held only part of the model's layers, passing intermediate results along the chain like an assembly line. The improvised cluster ran inference at 0.39 tokens per second — slow by data-center standards, but proof that meaningful AI workloads can execute on hardware that costs less than a dinner for two.
The second strand examined network propagation. Researchers set up eight Google Cloud nodes running Android 15 emulators inside a virtual private cloud and seeded an agent that moved between them through an unauthenticated Android Debug Bridge port. GLM-5.2, a 744-billion-parameter model, orchestrated the delivery of a much smaller Llama 3.1 8B model to all eight nodes in four out of five trials, and to seven nodes in the remaining run. No other open-weight model tested could complete the sequence without GLM-5.2's direction.
That distinction matters. The large model was not replicating itself onto the emulated devices; it was planting a smaller model that the target hardware could actually run. Anthropic's own write-up frames this as evidence that a model of GLM-5.2's capability level could, if compressed into the 9B-to-26B parameter range, complete the full replication chain on cheap hardware. But that compression has not been demonstrated, and the gap between "smart enough to replicate" and "small enough to fit" remains the central unresolved constraint.
Why shutting it down would be hard
A traditional botnet has command-and-control servers. Take those down, and the infected devices go quiet. A weight-based replicator — malware that propagates AI model weights alongside the software needed to run inference — would have no such single point of failure. Each compromised device becomes a self-contained node in a distributed intelligence, capable of probing unfamiliar hardware and adapting without instructions from above.
Anthropic drew comparisons to biological systems, describing the potential outcome as a "slow, distributed 'digital slime mold'" that persists on poorly secured computing resources. The company also noted that such replicators could pass adaptations to subsequent copies, citing the Memento framework used in its experiments. When an infection attempt failed, the model recorded notes on what went wrong before crashing; those notes were then inherited by the next iteration. In one series, success rates climbed from 45% to 84% across generations as each new copy learned from its predecessor's mistakes.
Curiously, giving small models access to a powerful "frontier mentor" — Anthropic's own Opus 4.8 — did not help. The smaller models often did not know what to ask, the researchers found, and performed better when left to iterate on their own.
The speed problem
The threat is not imminent in the way a Mirai-style outbreak is imminent. When Mirai emerged in 2016, it doubled its infected population in roughly an hour. Anthropic estimates that an AI replicator would take days to double, and possibly much longer. Setting up an inference environment on a new host would take an estimated 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B at the throughput observed on the test TV boxes.
Model weights are also enormous compared with conventional malware payloads. Distributing multi-gigabyte files across thousands of compromised devices would generate conspicuous network traffic, making detection easier than with traditional worms. Anthropic acknowledged this trade-off: the very thing that makes AI replicators dangerous — their adaptability — also makes them slow, loud, and resource-hungry.
The company did attempt to quantify what a worst-case fleet might look like. Using the Kimwolf botnet, which infected more than two million devices at its peak, as a reference point, Anthropic calculated that such a population could support roughly 133,000 instances of Gemma4-26B-A4B if every 15 devices collectively hosted one model. At measured throughput, that fleet would deliver approximately 40 Hopper H100-equivalents of inference capacity — a figure that sounds impressive until one considers the two million infected devices required to produce it.
What comes next
Anthropic's projection hinges on a single variable: the rate at which small models improve. Using historical gains in general AI capability as measured by the Epoch Capabilities Index, the company said models in the 30-billion-parameter class could reach the necessary capability level by the end of this year. Weight-based replicators in smaller size classes would follow "soon after."
The company stopped short of predicting exactly what form autonomous replication would take. The possibilities it outlined range from the slow, distributed slime-mold scenario to a "powerful cyber model that breaches datacenters at a high pace" or even models that scam people for compute credits. The common thread is the absence of human control.
"We expect a future awash with agents running on all types of hardware, including some that aren't under human control," the company wrote. It urged system hardening to make spreading harder, while also preparing for a world where such replicators "are here to stay."
The warning arrives amid a broader escalation of safety rhetoric from frontier labs. In September, improvements in leading models prompted industry-wide warnings about existential risk. Anthropic researcher Evan Hubinger recently put the odds of AI wiping out humanity within a decade above 10%, while the company's August risk report raised its assessment of misalignment risk in high-stakes settings from "very low" to "low."
Critics have noted that Anthropic's experiments relied on deliberately simplified conditions: exposed ADB ports, removed security steps, and a custom harness that the company itself acknowledged provides "an upper bound on real-world success." The cyber-exploit element of replication was largely set aside, with the company pointing to earlier papers as evidence that small models can handle vulnerability exploitation when given the right tools.
Still, the core finding stands on its own: the individual pieces of an AI worm — hardware adaptation, inference setup, network propagation, experience transfer — are no longer theoretical. What remains is the integration, and the compression of capable models into packages small enough to hide in a smart oven.