Anthropic, the artificial intelligence (AI) company in San Francisco, California, that makes the Claude chatbot, said in new research that small AI models may be only months away from copying themselves onto cheap internet-connected gadgets. Its researchers named off-brand Android TV boxes and smart ovens as possible hosts, and said such copies would not need a data centre to run.
The work comes from Anthropic’s Frontier Red Team, which probes models for dangerous abilities, and is credited to researchers William Zhou and Daniel Freeman. In their tests, a model with 9B parameters, the learned values often used to measure a model’s size, set up working AI software on 8 of the 9 hardware types tried. Models of 30B parameters or fewer handled many single steps but made mistakes when chaining them together.
Among the open-weight models tested, meaning ones whose files anyone can download, only GLM-5.2 from Chinese developer Zhipu AI completed the full replication chain in Anthropic’s simplified tests. If small models keep improving at their historical rate, the researchers expect them to reach that level by the end of 2026. Weight-based replicators, which run their own model directly on hijacked hardware, may follow soon after.
The team stopped short of claiming a working threat. “We don’t yet have a full rogue replicator, but agents are becoming increasingly capable,” the researchers wrote. Such a program would be hard to stop because “there’s no centralized point to shut off”, they said, though its spread may be slow, with a doubling time of days.
What The Lab Actually Set Up
A worm is a program that copies itself between computers without a person stepping in. Anthropic’s full replication test ran inside a firewalled network of eight Google Cloud computers, each running an emulated copy of Android 15 rather than a real device. The researchers placed the first copy of the worm on one machine and let it try to spread.
Each machine left open an Android Debug Bridge (ADB) port, a developer connection for controlling Android devices, with no password on it. On each target, the worm had to set up an AI model server that passed correctness and anti-cheating checks before a new copy of the worm started there. GLM-5.2 reached all eight machines in four of its five trials and seven of the eight in the other.
Anthropic made the break-in step easy on purpose. Its evaluation “keeps the cyber-exploit element of the replication trivial”, the researchers wrote, so the results mark an upper bound on real-world success. They also noted that an earlier botnet, or network of hijacked machines, called Mirai got into devices using default factory logins, so real Internet of Things (IoT) security may not be much harder.
The worm’s own model ran on a separate server, because the emulated machines were too small for the larger models. The model each infected machine served was Meta’s Llama 3.1 8B, not a copy of the worm’s own model.
When the researchers scripted the AI setup step, even a model with 3B parameters reached about half the machines in a larger 17-machine test, which joined two networks through a single linking machine. That suggests setting up the AI software, rather than the rest of the job, is the main hurdle for small models.
Fifteen TV Boxes And A Slow Model
To see whether cheap consumer hardware could carry a capable model, the team bought and networked 15 off-brand Android TV boxes costing about $55 each, with 4GB of memory apiece. They split a 26B-parameter version of Google’s Gemma 4 model across the boxes, and it produced text at about 0.39 tokens a second. A token is a fragment of a word.
The researchers estimated that, at speeds like these, setting up AI software on a new host would take the Gemma model about 71 to 150 hours and the 9B-parameter version of Alibaba’s Qwen 3.5 about 28 to 51 hours. The demonstration used real hardware, but it tested whether the boxes could run a model, not whether a worm could spread between them.
Anthropic’s yardstick was Kimwolf, a botnet that security firm Synthient found had infected more than two million devices, mostly Android devices with an exposed ADB service. Scaled to a fleet that size, the researchers estimated about 133,000 model copies producing around 80,000 tokens a second in total. That is roughly the output of 40 Nvidia H100s, a chip widely used to run AI in data centres.
The researchers called this a tiny amount of computing power and a rough estimate, since it rests on one class of device and one past botnet. They added that an AI botnet could act to counter defenders, but said they have not tested this.
Small Models Learn From Notes
The team ran its agents in Memento, a harness built on the open-source Pi coding agent that restarts an agent with notes from the previous one so it does not fixate on a wrong idea. Over six generations of the small Qwen model passing notes down the line, setup success rose from 45% in the first generation to between 61% and 84% in later ones.
Anthropic’s own Claude Opus 4.8 helped little as an adviser. Giving the small Qwen model access to it produced no significant improvement, and in a separate test on coding problems, a small model trained to use an adviser still struggled to ask for help well.
The end-of-2026 forecast rests on the Epoch Capabilities Index (ECI), a combined score of AI ability across many benchmarks from the research group Epoch AI. On it, open-weight models with 30B parameters or fewer have gained about 13.7 points a year, though the researchers called it only a rough proxy for replication skill.
How Earlier Studies Compare
Researchers at Fudan University in Shanghai, China, reported in December 2024 that Meta’s Llama 3.1 70B and Alibaba’s Qwen 2.5 72B each created a live, separate copy of themselves, in 50% and 90% of trials respectively. That preprint looked at much larger models and did not involve consumer gadgets.
The UK’s AI Security Institute (AISI) took a wider view in April 2025 with RepliBench, a set of 20 evaluations covering how a model might obtain its own files, find computing power, raise money and keep itself running. It found that the seven frontier models tested could not yet manage every part of replication.
“While current models don’t present an immediate threat of autonomous replication, the pace of improvement suggests this situation could change rapidly,” the institute wrote. Anthropic’s study turns the same question towards cheap home hardware.
The Old IoT Problem Underneath
Mirai, which spread in 2016, broke into IoT devices by trying 62 common factory default usernames and passwords, the US Computer Emergency Readiness Team (US-CERT) warned at the time. A later academic study put its peak at around 600,000 infected devices.
Anthropic said replication would leave traces that internet service providers (ISPs) can spot, such as multi-gigabyte downloads, AI traffic between devices and network scanning. Decoy devices called honeypots could also capture a worm’s code. In a study of the Mirai clean-up that Anthropic cites, an ISP that quarantined and notified infected customers saw 92% of infections cleared within 14 days, against 74% with no notification.
The researchers said manufacturers can also shrink the pool of targets, noting that “default IoT passwords are now non-compliant in UK markets”. The UK’s smart device rules under the Product Security and Telecommunications Infrastructure (PSTI) Act have banned such passwords since 29 April 2024. They also require makers to publish how long devices will get security updates and to offer a way to report flaws.
In the European Union (EU), the Cyber Resilience Act has required manufacturers since 11 September 2026 to report actively exploited flaws and severe incidents. Its core rules on secure design and updates apply from 11 December 2027.
For now, Anthropic’s evidence comes from emulated devices with the door left open and one slow demonstration on real TV boxes. Its researchers describe a capability drawing closer rather than a worm loose in the wild, and the secure defaults they point to as a defence are already written into UK and EU rules.
