Anthropic Warns Small AI Models May Soon Replicate on IoT
Controlled experiments show progress toward AI self-replication, but the forecast depends on improving reliability and does not demonstrate a rogue system spreading through real devices.
Listen
AI narration
11:14
0:00 / 11:14
AI SummaryGenerated from this article
Anthropic researchers demonstrated that smaller AI models can replicate themselves across unfamiliar hardware, with a 9-billion-parameter model successfully establishing inference on eight of nine tested devices. The findings suggest capable models may achieve autonomous self-replication within months if improvement continues. However, the controlled experiments did not demonstrate actual rogue systems spreading through real devices. Stronger models completed full replication only in simplified cloud environments with deliberately weak security and no realistic authentication or network restrictions. Operators should immediately secure exposed management interfaces and limit device-to-device connectivity to reduce vulnerability before small models become more reliable.
A 9-billion-parameter AI model got inference running on eight of nine hardware types in an Anthropic evaluation. The result shows progress toward an AI system copying itself onto unfamiliar machines, though it falls short of demonstrating an autonomous worm spreading through an unsecured device fleet.
In their October 12, 2026 Frontier Red Team report, Anthropic researchers William Zhou and Daniel Freeman describe two findings: inexpensive consumer hardware can collectively run a capable model, and relatively small models can already complete many individual tasks needed for replication. Stronger models completed an end-to-end replication task in a simplified environment.
The researchers did not build a full rogue self-replicator. Their warning that small models may be only months away from that capability is a forecast based on continued improvement. They observed no such deployment or evidence of AI escaping into household devices.
For operators, the immediate concern is weakly authenticated management interfaces. These could give increasingly capable software agents both somewhere to execute and enough computing resources to continue operating.
Cheap TV Boxes Supplied Compute, Not Proof of Propagation
One of the report’s most concrete demonstrations used 15 physical Android TV boxes costing about $55 each. The researchers networked them together and ran Gemma4-26B-A4B across the cluster at 0.39 tokens per second.
The model’s layers were split among the devices, which communicated to perform inference: generating outputs from an already trained model. Each box did not run an independent copy.
The experiment establishes hardware feasibility. A capable model does not necessarily need a data-center GPU if it can distribute the work across enough smaller devices. Speed was a limitation, however. At 0.39 tokens per second, generating a single token took roughly 2.6 seconds. The hardware sustained inference, but it did not deliver fast consumer-assistant performance.
Slow generation does not automatically rule out malicious use. A replication process could operate over much longer timescales than an interactive conversation. Low throughput would still constrain how quickly an agent could reason through problems, debug failures, and prepare another deployment.
The physical TV-box experiment was separate from the end-to-end replication evaluation. Combining those results into a claim that an AI autonomously infected 15 retail devices would misrepresent the work. One experiment tested available compute; the other tested whether an agent could complete a replication workflow under controlled conditions.
Work with Zeniteq
Let’s work together
We’re open to thoughtful collaborations with teams building in AI. Explore the ways we can work together.
Small Models Could Set Up Inference but Struggled With Longer Workflows
Anthropic divided replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host.
The study concentrated on inference setup, a less commonly measured part of that chain. Its hardware evaluation asked models to get Llama3.1-8B running across heterogeneous systems. Qwen3.5-9B, the 9-billion-parameter model highlighted in the report, succeeded on eight of nine tested hardware types.
Getting inference running requires more than transferring a file. An agent must select a compatible inference stack, resolve package and version problems, and debug hardware- or operating-system-specific failures. Decisions depend on earlier decisions, so an incorrect assumption can derail everything that follows.
Models with 30 billion parameters or fewer could already perform many individual replication steps, the researchers report. Their weakness was combining those steps into a successful longer run. A model that can configure inference on several platforms may still fail when it must discover another machine, transfer what it needs, start a working copy, and continue without human correction. Component-level success does not establish dependable end-to-end behavior.
The surrounding agent software also affected performance. Anthropic used a custom harness called Memento, built on the open-source Pi coding agent, to address a recurring failure mode: agents becoming fixated on an incorrect explanation and continuing down an unproductive path.
One Qwen agent spent hours debugging package versions when the actual problem was an endpoint incompatible with the evaluation API. The example illustrates the reliability gap: coding ability alone does not guarantee that an agent can recognize a mistaken diagnosis and recover.
The Cloud Test Deliberately Removed an Entry Barrier
For the controlled replication demonstration, the researchers used Google Cloud and redroid Android instances with a deliberately weak, unauthenticated Android Debug Bridge setup.
ADB is an Android debugging interface. The lack of authentication made gaining execution much easier than it would be on a properly restricted device. Anthropic characterizes the simplified setup as an upper bound on real-world success, rather than a realistic compromise scenario.
Within that environment, GLM-5.2 and stronger models completed the end-to-end replication task. Sufficiently capable agents could connect the component steps when important obstacles were removed. The result does not establish that those agents can reliably breach arbitrary Android devices, navigate typical security controls, or persist across a heterogeneous fleet.
The researchers largely set aside the first two stages of their replication chain, target discovery and exploitation, to focus on getting inference running and continuing propagation. They cite earlier cybersecurity research as evidence that small models can perform exploits with suitable tools. Those prior results should not be mistaken for exploitation demonstrated across the consumer devices in this study.
The hardware list also needs to be read carefully. Successfully configuring inference on a particular chip measures deployment competence after an agent has an opportunity to work on the machine; it does not show that the chip is vulnerable.
Successful replication in an assigned task likewise says nothing about whether a model independently decided to escape. This was a capability evaluation, with no evidence of spontaneous uncontrolled behavior.
The End-of-2026 Claim Depends on Continued Improvement
Anthropic’s forecast is conditional: if small models improve at their historical rate, the researchers expect them to match the demonstrated end-to-end capability level by the end of 2026. From the report’s October publication date, that is the basis for the “months away” warning.
Three claims need to remain separate:
Observed capability: Small models completed many component tasks, including inference setup across unfamiliar hardware.
Observed capability under simplified conditions: Stronger models completed a full replication workflow.
Projected capability: Small models may reach that end-to-end level by the end of 2026 if improvement continues.
The final claim is not a deployment date. It does not establish that an autonomous malware system will be released, that it will successfully compromise real fleets, or that every obstacle left outside the evaluation will be solved.
The researchers explicitly say they did not build a full rogue self-replicator. Their work narrows a technical uncertainty while leaving much of the threat model unresolved.
The TV-box demonstration does weaken the assumption that substantial centralized computing infrastructure would always be necessary to keep such a system running. If inference can operate on compromised devices, disabling access to a model-provider API would not necessarily stop an already distributed copy.
Deployment reliability therefore deserves attention alongside cybersecurity capability. Gaining access to a device and turning that access into a functioning, continuing agent are separate requirements.
Operators Should Close the Paths the Evaluation Left Open
Operators can act now on exposed execution paths, especially on devices that receive less security attention than servers and employee computers.
The evaluation’s unauthenticated ADB setup identifies a preventable weakness. Operators can reduce that class of exposure before small models become more reliable:
Review reachable management interfaces. Identify which devices expose debugging or administrative services and whether those services are reachable beyond the networks that need them.
Limit device-to-device connectivity. Segment IoT equipment so that execution on one device does not automatically provide convenient access to others.
Maintain a containment plan. Keep an inventory, apply available security updates, and retain a practical way to isolate suspicious devices.
These recommendations follow from the demonstrated conditions; the experiment did not measure the controls’ effectiveness.
The absence of administrator privileges should not be treated as sufficient protection. Anthropic notes that inference engines can run in userspace. Root access could help an attacker establish persistence, but it is not necessarily required to run a model once code execution is available.
Unexpected large downloads, sustained resource consumption, or unusual connections between devices could warrant investigation against a device’s expected role. None is a unique signature of AI replication, and the report does not establish a production-ready detector.
The most useful next evaluation would test whether the replication chain remains reliable when authentication, restricted connectivity, heterogeneous software, and recovery failures are brought back into scope. Until then, Anthropic’s results support a warning about a narrowing capability gap, not a claim that small-model IoT worms have arrived. Closing execution paths on exposed fleets is a defensible action now, regardless of whether the end-of-2026 forecast holds.
