Anthropic: small AI models may soon self-replicate on IoT devices

Anthropic researchers William Zhou and Daniel Freeman argue that small AI models may be only months away from being able to self-replicate on poorly secured internet-of-things hardware — smart ovens, fridges, vacuums and off-brand Android TV boxes — without needing a datacenter GPU.

What they demonstrated

In a controlled demo, Gemma4-26B-A4B ran across 15 inexpensive Android TV boxes (~$55 each) via pipeline-parallel sharding at about 0.39 tokens/s. Separately, a 9B model got inference working on 8 of 9 hardware types tested (from Jetson Nano to desktop GPUs).

In a firewalled GCP fleet of Android emulators with an unauthenticated ADB port, GLM-5.2 completed end-to-end replication (scan → copy payload → stand up inference → continue) on 8/8 nodes in most trials. Anthropic calls that an upper bound: the cyber step was deliberately trivial.

Why IoT matters

Many cheap set-top boxes run lightly patched Android forks with 1–4 GB of RAM. At 4-bit quantisation, a 9B model can be split across a handful of boxes; a 26B class model across roughly ten or more. Anthropic compares the threat to past botnets such as Kimwolf and Mirai, but notes an AI worm is not tied to one device family and can adapt notes between generations.

Timeline caveat

Models under ~30B already complete many individual replication steps but still stumble when chaining them. Anthropic’s trend fit puts a small model at GLM-5.2-class replication ability around end of 2026 — a rough Epoch Capabilities Index proxy, not a calendar guarantee.

Defences they highlight

ISP flow anomalies (large weight transfers, unusual device-to-device traffic), honeypots, subscriber quarantine (as used against Mirai) and harder IoT defaults (for example banning default passwords) all push the effective reproduction number below one.

Our take

This is a lab warning, not a live worm in the wild. The useful takeaway for smart-home buyers is boring but real: change default credentials, patch when vendors ship updates, and treat untrusted Android TV sticks as untrusted computers.