Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers.
The company’s experiments showed that models could identify unfamiliar devices, connect them into a network, and prepare them to run an AI model.
Although the researchers successfully distributed the Gemma4-26B-A4B model from Google DeepMind on 15 off-brand Android TV boxes, they did not demonstrate a fully autonomous, self-replicating AI worm running on real IoT hardware.
However, they estimate that smaller models could achieve self-replication by the end of the year if they continue to improve at their historical rate.
“Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes,” Anthropic warns.
“ A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days).”
Source: Anthropic
Replication experiment
Anthropic ran its replication experiment using cheap Android TV boxes, and the AI models Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8, and GLM-5.2, each assigned a different role.
Qwen3.5-9B and GLM-5.2 acted as agents tasked with setting up and propagating Llama3.1-8B (inference), while Gemma4-26B-A4B demonstrated that a model could run across 15 Android TV boxes. Opus 4.8 was separately tested as an advisor to Qwen.
The experiment used a simplified setting where the targets exposed unauthenticated ADB access.
Source: Anthropic
The experiments showed that Qwen3.5-9B successfully installed and configured the software needed to run Llama3.1-8B on eight of the nine hardware types tested.
GLM-5.2 reached all eight nodes in the controlled emulated network in four out of five trials, but the other models failed to complete the full process reliably.
Anthropic observed an improvement in success rate when it retained data from previous attempts, with Qwen3.5-9 B’s success rate rising from 45% early on to 84% in later generations.
Source: Anthropic
Using the stronger Opus 4.8 model to assist Qwen in inference produced no measurable improvement.
Based on the results and historical data, Anthropic predicts that models with 30 billion parameters or fewer could reach the necessary capability level by the end of 2026.
On the studied hardware, the inference setup would be a slow process, taking between 28 and 51 hours for Qwen3.5-9B, and 71-150 hours for Gemma4-26B-A4B, giving defenders enough time to detect and respond.
However, this time could shrink with future models, so implementing stronger security measures for IoT may soon become a priority.
Proposed defenses include detecting large model transfers and unusual device-to-device traffic, using honeypots to inspect payloads, quarantining infected subscribers, and improving IoT security defaults.
While Anthropic’s warning is not based on an imminent threat, as their experiment failed to demonstrate full end-to-end worm-creation capability at this stage, even with lowered security settings and explicit propagation goals, the message for better IoT security remains valid.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
