Anthropic Research Finds Small AI Models Nearer to Autonomous Replication Across IoT Networks

In a research report published on October 12, Anthropic described experiments testing whether relatively small AI models could configure themselves to run on unfamiliar hardware and coordinate the steps required to reproduce across a network. The company warned that continued improvements could make such systems more feasible by the end of 2026.

The findings do not establish that an autonomous AI worm is currently spreading through smart-home devices. Instead, they identify technical capabilities that could contribute to such a threat, particularly if attackers gained access to poorly secured internet-connected equipment.

Experiments Demonstrate AI Inference Across Low-Cost Hardware

Anthropic examined whether AI models could prepare the software needed to run a model across different hardware configurations. This process, known as inference setup, involves selecting compatible software, installing the necessary packages, resolving technical problems, and configuring the hardware to execute a model.

The company tested several models, including Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, and GLM-5.2.

ABC News reports that Anthropic researchers warn AI models under 30 billion parameters could soon self-replicate across vulnerable IoT devices without human intervention. Source: ABC News/X

In one demonstration, researchers distributed Google’s Gemma4-26B-A4B model across 15 inexpensive, off-brand Android TV boxes. Each device handled part of the model, allowing the group to perform inference collectively rather than requiring a single machine to run the entire system.

The demonstration produced approximately 0.39 tokens per second. This is a slow processing rate compared with conventional AI infrastructure, but the experiment showed that a collection of relatively inexpensive consumer devices could contribute computing resources to a shared AI workload.

The result matters because many connected devices have limited processing power individually but are widely distributed and connected to local networks or the internet. If compromised devices could cooperate to run AI models, an attacker might be able to assemble computing capacity from hardware that was not originally designed for such workloads.

However, running an AI model across several devices is different from developing an autonomous system that can find vulnerable targets, gain access, install itself, and repeat the process without human intervention. Anthropic investigated these stages separately.

Simulated Network Test Reveals Progress and Technical Limitations

The researchers also tested autonomous replication in a controlled environment containing eight emulated Android devices hosted on Google Cloud infrastructure.

The experiment used an unauthenticated Android Debug Bridge port. This simplified the access stage and allowed researchers to concentrate on whether models could coordinate the remaining steps. It also means the setup was less secure than a properly configured network of consumer devices.

Among the tested open-weight models, GLM-5.2 demonstrated end-to-end replication under these conditions. It reached all eight nodes in four out of five trials and reached seven nodes in the remaining trial.

The experiment involved deploying and configuring Llama3.1-8B on the target nodes, rather than demonstrating that every model tested could autonomously reproduce itself across physical smart devices. Anthropic used this approach to assess whether models could perform the technical work necessary for a replication process.

The company also found that some models could establish inference on unfamiliar hardware with varying degrees of reliability. In tests involving Qwen3.5-9B, success improved over repeated attempts when later runs could use notes from previous attempts.

Those results suggest that models may become more effective at handling unfamiliar systems as their capabilities and supporting tools improve. Yet the experiments did not demonstrate a fully autonomous AI worm infecting ordinary consumer devices under normal security conditions.

Anthropic Projects Further Advances by the End of 2026

Anthropic estimated that AI models with 30 billion parameters or fewer could reach the capability threshold needed for autonomous replication by the end of 2026 if their performance continues improving at its historical rate.

The estimate is a projection based on observed model progress, not a confirmed deadline. The researchers also acknowledged that individual models still make mistakes when attempting to combine the separate stages into a reliable process.

Speed presents another limitation. On the hardware examined, setting up inference could take many hours. Anthropic estimated that a Qwen3.5-9B-based setup could require approximately 28 to 51 hours, while the larger Gemma4-26B-A4B setup could take roughly 71 to 150 hours.

Such delays could give security teams opportunities to identify suspicious network behavior before a potential replication process spreads widely. Nevertheless, the time required could change as models, software, and hardware improve.

Anthropic also cautioned that AI-enabled malware could differ from traditional botnets. Conventional malicious programs often target specific operating systems or device types using predetermined instructions. An AI-assisted system could potentially adapt its software setup to unfamiliar environments, provided it had the necessary access and tools.

That adaptability remains a potential risk rather than a demonstrated ability to defeat security controls across the consumer internet.

Connected Devices Could Become Targets for Distributed AI Workloads

If attackers eventually develop reliable self-replicating AI systems, internet-of-things devices could offer a large pool of distributed computing resources. Potential targets could include Android TV boxes, smart appliances, security cameras, and other connected equipment with insufficient security protections.

Anthropic’s October 12 research warns that AI models under 30 billion parameters can perform many steps toward autonomous self-replication across everyday IoT devices. Source: Mint/X

A compromised network might be used to run AI inference across multiple machines without relying entirely on centralized data centers. Depending on the attacker’s objectives, the same infrastructure could potentially support other malicious activities.

The main obstacle is that a model must first gain the ability to execute code on a target device. It must then transfer the necessary files, configure the environment, and establish a working inference process. Weak passwords, exposed administrative interfaces, and outdated software could make some devices easier targets, but the presence of AI alone does not remove these access barriers.

Anthropic’s report also indicates that a distributed network of devices would have limitations. Processing could be relatively slow, while the transfer of large model files and the repeated communication between machines could create detectable network patterns.

The findings therefore point to a developing security concern rather than evidence of an imminent, widespread outbreak.

Network Monitoring and Stronger IoT Security Could Reduce Exposure

Anthropic outlined several approaches that organizations and service providers could use to detect or contain potential AI-enabled worms.

Unusual transfers of large AI model files may be one warning sign. A sudden increase in communication between devices that do not normally exchange substantial amounts of data could also indicate suspicious activity. Repeated connection attempts and unexpected outbound traffic may provide additional clues.

Researchers also suggested using honeypots, or decoy systems, to study suspicious payloads and understand how a replicating system operates. Internet service providers could isolate potentially infected networks and notify affected customers, limiting opportunities for malicious software to spread further.

Device manufacturers have a separate role in reducing exposure. Stronger default security settings, unique credentials, restricted administrative access, and timely software updates can help close common entry points before attackers exploit them.

Consumers and small businesses can also reduce risks by changing default passwords, updating device firmware, disabling unnecessary remote access, and avoiding direct exposure of device-management interfaces to the internet.

Anthropic’s experiments show that AI models are advancing in their ability to configure software and coordinate complex technical tasks. They do not establish that autonomous replication is already a routine capability on real-world consumer networks.

The central security question is whether future models will become reliable enough to combine these individual skills while operating on vulnerable machines. Continued improvements could make the threat more practical, but stronger device security and effective network monitoring could help constrain its spread.