Anthropic warns small AI models could soon copy themselves across smart TVs and ovens

Anthropic’s security researchers say small AI models may be only months away from being able to copy themselves across cheap household gadgets with no data centre involved. In research published on Monday, the company’s Frontier Red Team says its experiments suggest small models could soon “self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes”, and that such a replicator would be hard to stop.

The post, by researchers William Zhou and Daniel Freeman, stresses that nobody has built a working rogue replicator yet. But it says the individual steps are falling into place, and puts a rough date on when small models could manage the whole chain: the end of 2026.

A 26B model running on 15 TV boxes

To show that weak hardware can host a capable model, the team bought 15 off-brand Android TV boxes at about $55 (roughly £41 or €47) each, networked them together and ran Google’s open Gemma4-26B-A4B model across them, with each box holding a slice of the model’s layers. It ran at 0.39 tokens per second, slow but working.

The researchers point to Kimwolf, a botnet that infected more than two million devices, mostly off-brand Android TV boxes, as the realistic template. If a fleet that size were split into groups of 15, it would hold about 133,000 copies of the model, roughly 40 H100 chips’ worth of computing power in total. They say other gadgets with enough memory to run a share of a model under 30 billion parameters include smart fridges, smart ovens, robot vacuum cleaners and lawnmowers.

Which models can already do it

The team split replication into four stages: finding targets, gaining access, getting the model running and spreading on from the new host. It focused on the third, the least studied. In its tests, a 9B model, Qwen3.5-9B, got inference running on 8 of the 9 hardware types tried, from Nvidia Jetson Nano boards to Macs and RTX 4090 graphics cards.

It then built a sealed network of eight cloud machines running an Android emulator and dropped in a “worm” to see which models could hop from machine to machine on their own. Only one open-weight model managed the full cycle: GLM-5.2, from China’s Z.ai, which spread to all 8 nodes in 4 out of 5 trials and 7 of 8 in the fifth. Anthropic notes the test made the hacking step trivially easy, so the result is an upper bound, though it points out that the Mirai botnet spread simply by trying factory-default passwords.

GLM-5.2 is too big to fit on a TV box. The question is when small models catch up. Plotting open models of 30B parameters or fewer against Epoch AI’s Capabilities Index, the researchers say the trend “puts a small model at that level by the end of 2026”, while warning that the index is only a rough proxy. Anthropic flagged the cyber skills of a later Z.ai model, GLM-5.3, last month.

“Signs of life for AI worms”

The authors liken the likely result to a slow “digital slime mold” rather than a fast-moving virus, with each new copy taking a day or two to set itself up. They also found the models could learn as they spread: when copies of Qwen3.5-9B passed notes to their successors, the setup success rate rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model access to Anthropic’s far stronger Opus 4.8 as an adviser made no measurable difference.

The post’s conclusion is blunt:

Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain.

William Zhou and Daniel Freeman, Anthropic Frontier Red Team

How defenders could fight back

The team says the goal is the same as with an epidemic: push the number of new devices each infected one infects below one. A worm shipping multi-gigabyte model files between gadgets that never normally talk to each other should stand out to internet providers. It cites a Mirai clean-up in which an ISP quarantined infected customers and cleared 92% of infections within 14 days, against 74% without notification. Manufacturers can help by dropping default passwords, which UK rules already ban. The work comes as Anthropic pushes its own models into cyber defence and opens up hacking tools to vetted red teams.

Why it matters

Self-replication has long been treated as a far-off red line for AI safety. Anthropic’s own red team now says the barrier may be the capability of small open models rather than access to expensive chips, and that the billions of poorly secured gadgets already in homes could be enough to host them.

Sources: Anthropic Frontier Red Team, “AI models may be capable of self-replicating without access to a datacenter”.