Anthropic warns self-replicating AI could pose cybersecurity risks

• Anthropic found that smaller AI models can perform replication steps, but reliability remains limited.
• Compromised IoT devices could enable AI replication and pose security risks.

AI models are getting closer to being able to replicate across internet-connected devices without human intervention, according to new research from Anthropic. The company found that smaller models can already complete many of the tasks required for autonomous replication, although they still struggle to carry out the entire process reliably.

In a research report, Anthropic said models could eventually operate across networks of compromised devices without relying on traditional data centres. Its experiments showed that commercially available IoT hardware, including low-cost Android TV boxes, has enough collective computing power to run AI models.

Researchers from Anthropic’s Frontier Red Team examined the steps involved in autonomous replication, including identifying target devices, gaining access, setting up AI inference, and continuing the process on other machines. The study focused primarily on configuring models to run on unfamiliar hardware rather than exploiting security vulnerabilities.

How self-replicating AI works across connected devices

Anthropic found that AI models containing 30 billion parameters or fewer could already complete many individual tasks involved in replication. However, these models struggled to execute the entire process consistently without errors.

In one experiment, a nine-billion-parameter model successfully established AI inference on eight of nine hardware types tested. Smaller models were also able to configure inference software across different systems, including Jetson Nano devices, Mac computers, and machines equipped with Nvidia RTX 4090 graphics cards.

The researchers also demonstrated that larger models could operate across multiple low-cost devices. They ran Google’s Gemma4-26B-A4B model on 15 inexpensive Android TV boxes, each costing approximately US$55 and containing 4GB of memory.

By distributing the model’s layers across the devices, the researchers achieved a processing speed of 0.39 tokens per second. The experiment demonstrated that inexpensive connected hardware could collectively run AI inference, although performance remained limited.

Anthropic separately tested autonomous replication in a controlled Google Cloud environment using eight Android emulator nodes. The experiment examined whether AI models could identify other devices, transfer the necessary files, and establish inference on additional machines.

GLM-5.2 performed best, successfully deploying Llama3.1-8B across all eight target nodes in four of five trials and reaching seven nodes in the remaining trial. The larger model ran on separate inference infrastructure, while the target devices were accessible through unauthenticated connections.

Anthropic said the simplified access conditions made the results an upper bound on real-world replication success. The researchers did not evaluate whether the models could independently exploit vulnerabilities and spread across secured networks.

Anthropic’s research examined a potential category of malware that carries the AI model itself between compromised devices. Unlike botnets such as Kimwolf, which target particular categories of hardware, AI-based replicators could adapt to unfamiliar devices by configuring the software needed to run their models.

The researchers also tested whether models could improve their performance using information from previous attempts. In experiments involving Qwen3.5-9B, inference setup success rates rose from 45% initially to between 61% and 84% when later instances inherited notes about earlier attempts.

Anthropic cited the Kimwolf botnet, which reportedly infected more than two million devices, primarily Android TV boxes, as an example of the scale of existing IoT malware. However, running AI models on this hardware remains computationally demanding.

Based on experimental processing speeds, Anthropic estimated that completing an inference setup task would take between 28 and 150 hours, depending on the model. These were projected setup times on comparable IoT hardware, not observed replication times across real-world networks.

Detecting and containing AI threats across networks

Anthropic identified home and small-business IoT devices as potential targets because of their historically limited security protections. The research also identified business equipment, including security cameras and video-conferencing systems, with processors capable of running AI workloads locally.

The US Cybersecurity and Infrastructure Security Agency (CISA) identifies weak credentials, insecure interfaces, and insufficient network segmentation as common IoT security concerns. Its IoT risk and mitigation guidance warns that poorly segmented networks can allow attackers to move between connected IT and operational technology (OT) systems.

Containment presents another challenge. Anthropic warned that a weight-based AI replicator could continue operating across compromised devices even after its original deployment was disabled, leaving defenders without a single central system to shut down.

The researchers described containment using the reproduction number, or R₀, which represents the average number of additional devices infected by each compromised machine. Bringing that number below one would cause the spread to decline over time, although removing all infected copies could require coordination between multiple internet service providers.

Anthropic also identified network activity that could help defenders detect replication. Potential indicators include multi-gigabyte model downloads, sustained traffic between connected devices, and unusual outbound connections associated with network scanning.

Faster replication would generally produce more network traffic, increasing the possibility of detection through network monitoring. The researchers also proposed using honeypots, or decoy devices, to capture a replicator’s software and examine its behaviour.

Existing botnet research provides evidence that network restrictions can help contain infections. Anthropic cited a study of the Mirai botnet in which quarantine and customer notifications helped clear 92% of infections within 14 days, compared with 74% without notification.

Anthropic suggested that similar measures could provide an initial defence against weight-based AI replicators. However, these controls have not been tested against a real-world autonomous AI worm.

CISA’s cybersecurity guidance recommends maintaining inventories of connected devices, separating IoT equipment from critical systems, monitoring network activity, and addressing known vulnerabilities. These measures are intended to reduce exposure and restrict the movement of attackers between connected systems.

Device manufacturers also play a role in addressing IoT vulnerabilities. In its April 2026 guidance, the US National Institute of Standards and Technology (NIST) recommended incorporating cybersecurity considerations throughout IoT product development and providing customers with information to manage security risks.

NIST’s associated technical baseline, IR 8259A, identifies capabilities including device identification, access controls, configuration management, software updates, and cybersecurity-state awareness. These address existing IoT security weaknesses rather than threats specific to autonomous AI replication.

Anthropic projected that smaller AI models could reach the capability level demonstrated by GLM-5.2 in its simplified replication experiment by the end of 2026 if historical improvements continue. The researchers cautioned that the estimate relies on a general AI capability index rather than a direct measurement of autonomous replication.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.