Anthropic: small AI models could replicate on IoT devices
Its security team tested it in the lab with Android TV boxes and emulated networks; the company says the scenario was simplified and the timeline is its projection.
Anthropic's Frontier Red Team argues that small AI models could be "months away" from copying themselves onto cheap household devices, including generic Android TV boxes and connected appliances, without needing a data center. It makes the case in a study published on Oct. 12, 2026 by William Zhou and Daniel Freeman. No real-world case has been observed, and the team itself designed and evaluated the tests.
The study was covered by BleepingComputer on Oct. 13, with a caveat: it is not an imminent threat, and nobody has shown an autonomous AI worm working end to end on real devices.
What they tested
The authors measured two capabilities. The first is whether a small model can install another and leave it running on different kinds of hardware; the second, whether it can repeat that process from one node to the next in an emulated network. Anthropic deliberately simplified the hacking step, so it presents the results as an upper bound.
- Gemma4-26B-A4B ran split across 15 Android TV boxes, each costing about $55 and with 4 GB of RAM, at about 0.39 tokens per second.
- Qwen3.5-9B managed to get running on 8 of the 9 hardware types they tried.
- With eight emulated Android 15 devices on a network, whose debugging port required no authentication, GLM-5.2 spread to every node in four of five trials, and to seven of them in the fifth.
- When notes from earlier attempts were passed down across six generations of Qwen3.5-9B, installation success went from 45% to a range of 61% to 84%.
The full installation process would take between 28 and 51 hours with Qwen3.5-9B, and between 71 and 150 hours with Gemma4-26B-A4B, according to the company. An outside adviser, Opus 4.8, produced no measurable improvement.
The projection and the defenses
The timeline warning rests on the Epoch Capabilities Index, which the company says rises 13.7 points a year. At that pace, Anthropic estimates that by the end of 2026 a smaller model would match GLM-5.2. It is an estimate and not an observed result, and the authors themselves acknowledge it as an indirect indicator of replication ability.
Compared with classic botnets, which are tied to one device type, an AI replica would not depend on the hardware. The authors say it would be hard to shut down, since there would be no central node to cut.
The authors propose that internet providers watch their flow records for multi-gigabyte downloads and unusual communication between devices. They also call for honeypots (decoy machines), quarantine for infected subscribers and better factory settings, such as banning default passwords, something the United Kingdom already enforces. As a precedent, they note that when Mirai was cleaned up, quarantine with a notice eliminated 92% of infections in 14 days, versus 74% without a notice.
For people with cheap connected devices, the risk the study describes depends on factory security, such as open debugging ports. The report itself acknowledges that success would be lower against real defenses, and that its propagation estimate starts from a single type of hardware and from an earlier botnet, Kimwolf, which infected more than 2 million devices.
