Anthropic researchers say small AI models may be months from self-replicating on smart TVs and other IoT devices

Anthropic's Frontier Red Team says small AI models "may be months away from being capable enough" to copy themselves across home and small-business internet-of-things devices. That means smart ovens, smart TVs, off-brand Android TV boxes and similar gear. The research was published Monday, Oct. 12, by William Zhou and Daniel Freeman.

Their central warning is about containment. A replicator living on thousands of scattered devices would be "challenging to shut down," they wrote, "since there's no centralized point to shut off."

No such program is loose today. "We don't yet have a full rogue replicator," Anthropic wrote, "but agents are becoming increasingly capable of completing the individual steps in the replication chain."

What the experiments showed

The team bought 15 off-brand Android TV boxes at roughly $55 each and networked them. It then ran Gemma4-26B-A4B, a 26-billion-parameter model, split across the fleet. The setup managed 0.39 tokens per second, which is very slow, but it ran.

In a separate test, a 9-billion-parameter model got inference running on 8 of the 9 hardware types the researchers tried.

Models of 30 billion parameters or fewer can already complete many individual steps of replication, according to the researchers. They still make mistakes when chaining those steps end to end.

The stronger result involved GLM-5.2, a model from Zai. In a firewalled Google Cloud fleet of Android emulators with trivial remote-debugging access, GLM-5.2 was the only open-weight model the team tested that reliably completed the full cycle: scanning, delivering a payload and setting up inference for a stand-in Llama 8B server. On an eight-node network, it reached all nodes in four of five attempts and seven nodes in the fifth.

Anthropic labels that an upper bound. The cyber-exploit stages were deliberately simplified, and the researchers leaned on earlier published work (CyberGym, ExploitBench and research on adaptive worms) to argue small models can already handle those stages when given the right tools.

The timeline

The "months" estimate rests on a trend line. If small models keep improving at their historical rate, the researchers say, they will match GLM-5.2's capability level by the end of 2026. "Small weight-based replicators may be possible soon after."

That is a projection from Anthropic's own experiments, not an observed outbreak. The researchers also say the early versions would be sluggish. They put the doubling time at days, and a replication run on real smart TVs at a day or more for 9B-class setups.

The report's own analogy is that such worms would behave less like flash worms and more like persistent slime molds. Anthropic nonetheless argues slow edge replicators could be a bellwether for faster threats.

Why IoT devices

Data center GPUs would be "a clear, high-value target" for AI worms, the researchers said. But expensive accelerators aren't strictly necessary. Home and small-business IoT devices "might be the first target for such attacks because they're connected to the internet and, historically, have had minimal security measures in place."

They also argue an AI attacker changes the economics. "While it's true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world's IoT compute." And unlike conventional malware, an AI agent could work out unfamiliar devices on its own.

The weights themselves would become part of the malware payload. The team notes these programs would not need root privileges, because inference engines can run entirely in userspace. It points to crypto miners and botnets such as P2Pinfect and Fritzfrog, which operate without privilege escalation.

Defenses the researchers propose

The report is not only a warning. It lays out countermeasures, many borrowed from the fight against Mirai, the botnet that hijacked consumer devices years ago:

• Driving the replicator's reproductive number below one by spotting anomalies in ISP traffic flows.
• Deploying honeypots.
• Using subscriber-quarantine playbooks already proven against Mirai-era botnets.
• Requiring harder default security settings on IoT devices.
• Watching for unusual multi-gigabyte weight transfers between consumer devices.

The fourth item on that list is the one that falls on manufacturers. Cheap devices shipped with weak defaults are the attack surface the researchers describe. No regulator or standards body has been reported responding to the findings.

The research was run on Memento, a harness the team built on the open-source Pi coding agent. It periodically starts a fresh agent that inherits its predecessor's workspace and a short set of notes. Those inherited notes raised inference-setup success for Qwen-class agents. Advice from a stronger frontier model did not help the small models much.

What comes next

The findings are Anthropic's own results under simplified conditions. They are a capability warning, not evidence of an active campaign against consumer networks. The test case is the end of 2026, less than three months away. That is when Anthropic projects a small model will reach the capability level GLM-5.2 showed in its lab.