Anthropic Warns Small AI Models Could Soon Replicate Themselves on IoT Devices

Anthropic published a study on October 12, 2026, warning that small AI models may be "months" away from being able to copy themselves onto commercial internet of things (IoT) devices, such as cheap Android TV boxes. The authors stress that this is an estimate based on extrapolated trends, not an AI worm detected in the wild.

What was tested

The Frontier Red Team examined whether AI agents can get a model running on unfamiliar hardware and spread it further. The replication cycle consists of finding a target, gaining access, launching the model and repeating. The experiments were run in controlled conditions, not on the public internet.

In one test, the Gemma4-26B-A4B model was split across 15 cheap Android TV boxes. It worked, but at just 0.39 tokens per second. With 4 GB of RAM and 4-bit quantization, the authors say 9B models need at least four devices and 26B models at least ten.

Full replication in the lab

Only GLM-5.2 managed the full cycle. The test ran on an eight-node fleet in Google Cloud with Android emulators and an unsecured ADB port. The model reached all eight nodes in four of five trials, and seven in the fifth. It deployed Llama3.1-8B in the process, not itself.

The authors also checked whether agents learn from earlier attempts. When successive instances of Qwen3.5-9B received their predecessors' notes, the success rate of getting inference running rose from 45% to a range of 61-84%. Access to an advisor in the form of Opus 4.8 produced no measurable improvement.

Scale and limitations

By Anthropic's estimate, a fleet the size of the Kimwolf botnet, meaning more than 2 million devices, would yield about 133,000 replicas and about 80,000 tokens per second, equivalent to at most around 40 H100 cards. Based on measured speeds, the authors estimate that a full inference setup on TV boxes would take about 28-51 hours for Qwen3.5-9B and about 71-150 hours for an unoptimized Gemma4-26B-A4B.

Anthropic lists the caveats explicitly. The intrusion stage was deliberately simplified, so the results are an upper bound on what is possible in practice. The ECI index is only a proxy for replication ability, and the spread estimate rests on one class of hardware and one past botnet. Small models are also weak at spearphishing and social engineering, and the team did not test whether AI botnets could act intelligently against defenders.

According to the Anthropic Frontier Red Team, the conclusion is that systems should be hardened so that such replicators struggle to spread, while also preparing for a world in which they stay.

How to defend

The authors propose driving the reproduction number R0 below 1. They recommend that internet providers monitor for multi-gigabyte transfers, unusual device-to-device traffic and network scanning, and that defenders deploy honeypots to capture the replicator's code. They note that during the Mirai botnet, ISP quarantine and notification of infected subscribers cleared 92% of infections within 14 days, compared with 74% without notification.

The report says manufacturers should ship secure defaults, as in the UK ban on default passwords in IoT devices. For companies in Poland, the practical takeaway is simple: take inventory of cameras, conferencing equipment and unpatched IoT devices, and close debugging ports.

Wider context

Semafor notes that an Anthropic co-founder separately wrote that "recursive self-improvement" could arrive next year. Journalist Derek Thompson criticized the company, writing that its leaders should stop acting like a local news anchor reporting on traffic and acknowledge that they are the traffic. The study itself does not show a working AI worm in real networks.