Anthropic says small AI models may soon be able to copy themselves onto everyday connected devices without a datacenter. On 12 October 2026 its Frontier Red Team, in a post by William Zhou and Daniel Freeman, wrote that its experiments suggest small models "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices". The examples it gives are smart ovens and off-brand Android TV boxes.
This is a lab's own research, published on its own site, and it describes a projection built on simplified tests. Here is what it did and did not show.
What Anthropic tested
The team split autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. It largely set aside the first two, the cyber-exploit steps, citing earlier papers that it says show small models can already do them. It concentrated on the third, getting a model running on unfamiliar hardware.
Anthropic reports that a 9B-parameter model got inference running on 8 of the 9 hardware types it tested. In a separate passage, it says small models such as Qwen3.5-9B can set up inference servers on hardware from Jetson Nanos to Mac PCs and RTX 4090s. It adds that the chips were tested to measure how well models can set up inference on them, and that "the chips aren't a source of risk or vulnerabilities".
Anthropic says models of 30B parameters and under can already complete many of the individual replication steps, but make mistakes when composing them end to end.
The full-cycle test
To test the whole cycle, Anthropic built a firewalled network of 8 cloud nodes running an Android 15 emulator. A worm hopped from node to node over an unauthenticated ADB port, then set up an inference server to serve Llama3.1-8B. Anthropic says that, of the open-weight models it tested, only GLM-5.2 was capable of full end-to-end replication. It says GLM-5.2 spread to 8 of 8 nodes in 4 of 5 trials and to 7 of 8 in the other.
Anthropic is explicit that this is an upper bound. It kept the cyber-exploit step trivial, since the port had no authentication, and it says its result assumes GLM-5.2's capabilities could be packed into a Llama3.1-8B-sized model. It also points out that past IoT botnets have spread by going through default lists of manufacturer usernames and passwords, as Mirai did.
Where "months away" comes from
The timeline is a projection, not an observation. Anthropic writes that if small models improve at their historical rate, they will match GLM-5.2's capability level by the end of this year. It plots open-weight models of 30B parameters or fewer against the Epoch Capabilities Index, which shows a gain of 13.7 index points a year. It calls that index "only a proxy metric for replication ability", so the date is "only a rough estimate".
Crypto Briefing, reporting on the research the same day, also stressed that full replication has appeared in simplified evaluations and that the late-2026 date is a projection rather than an observed event.
What it would look like
Anthropic's demo ran Gemma4-26B-A4B spread across 15 off-brand Android TV boxes, bought for about $55 each, at 0.39 tokens per second. That is slow, and Anthropic says a replicator like this may be slow too, with a doubling time of days. It also says such a replicator would be hard to shut down, because there is no centralised point to switch off, and that unlike non-AI malware it could work out unfamiliar devices on its own.
For scale, Anthropic cites the Kimwolf botnet, which Synthient reported infected somewhere over 2 million devices at its peak, primarily Android TV boxes. If every group of 15 TVs in a fleet that size ran a copy of Gemma4-26B-A4B, Anthropic estimates about 133,000 replicas. That would be at most about 40 H100 GPUs' worth of inference, which Anthropic calls "a tiny amount of compute in absolute terms". It describes the estimate as rough, anchored on one class of hardware and one past botnet.
Adaptation and advice
Anthropic also tested whether replicators could learn as they spread. Across six generations of Qwen3.5-9B, each inheriting the previous generation's notes, the share of runs completing inference setup rose from 45% in the first generation to between 61% and 84% in later ones. When it gave Qwen3.5-9B access to a stronger model, Opus 4.8, as an advisor, Anthropic reports no measurable improvement. On whether an AI botnet could act intelligently to counter defenders, it says "we haven't tested this".
Defences Anthropic suggests
Anthropic argues defenders have some advantages. A replicator moving multi-gigabyte model payloads between devices would leave a network signature that ISP monitoring could spot. It points to the Mirai clean-up, where quarantining infected subscribers cleared 92% of infections within 14 days, against 74% with no notification, and it expects quarantining to be similarly effective as an initial defence. It also notes that default IoT passwords are now non-compliant in UK markets.
Anthropic says there is not yet "a full rogue replicator", but that agents are becoming increasingly capable of the individual steps. Crypto Briefing also pointed to a University of Toronto study of a self-replicating AI worm that, tested on a 33-host network of IoT devices, achieved a spread rate of around 62% within seven days. That is a separate piece of work, and the figures are Crypto Briefing's account of it.
My reading is that the finding is a measured one: a plausible direction of travel, stated with Anthropic's own caveats. The evidence is a simplified test, a trend line and a rough compute estimate, and it comes from a lab whose work on loss-of-control risks, as Crypto Briefing notes, treats autonomous replication and adaptation as a pivotal risk factor.
Sources
Almada Lopez, D. (2026) 'Anthropic warns small AI models may soon self-replicate on IoT devices', Crypto Briefing, 12 October 2026, available at: https://cryptobriefing.com/anthropic-small-ai-models-self-replicate-iot/ (Accessed: 15 October 2026).
Zhou, W. and Freeman, D. (2026) 'AI models may be capable of self-replicating without access to a datacenter', Anthropic, 12 October 2026, available at: https://www.anthropic.com/research/self-replicating-ai (Accessed: 15 October 2026).
.jpg?ref=theainewsfiles.com){kind=link}