Anthropic Tests How Small AI Models Can Replicate Across IoT Devices
Researchers found that current models can complete much of the replication chain, though tests stopped short of showing a real-world autonomous AI worm.
Topics
News
- Anthropic Tests How Small AI Models Can Replicate Across IoT Devices
- Zoho Freezes Pay Raises as AI Costs Surge
- NYT, Economist Join Publisher Push to Control AI Use
- Meta Releases Muse Wonder Models for Coding and AI Agents
- Fired OpenAI Researchers Warn Dismissals Could Chill Safety Work
- ARTEX Developer Closes AI Hacking Tool After Bank Attacks
Small artificial intelligence models may be nearing the capability needed to copy and run themselves across consumer devices without relying on data centers, according to new research from Anthropic on a potential form of autonomous cyber threat.
Researchers William Zhou and Daniel Freeman tested whether models could establish inference on unfamiliar hardware and repeat the process across other machines.
Anthropic said, Qwen3.5-9B, a 9-billion-parameter model, successfully got inference running on eight of nine hardware types it tested.
The researchers also ran Gemma4-26B-A4B across 15 inexpensive Android TV boxes costing about $55 each. The distributed setup reached 0.39 tokens per second, showing that capable models can run without data-center GPUs. Anthropic
The more consequential test examined whether a model could carry out an entire replication sequence.
In a firewalled network of Android emulators, GLM-5.2 was the only tested open-weight model to do so reliably, spreading to all eight available nodes in four of five trials and seven nodes in the fifth.
But Anthropic cautioned that the experiment simplified a crucial part of a real attack. The machines exposed an unauthenticated ADB port, meaning the model did not have to defeat realistic security protections before gaining access.
The researchers described the results as an upper bound on what current systems could achieve outside the lab.
Based on historical improvements in open-weight models with 30 billion parameters or fewer, Anthropic estimates that models could reach GLM-5.2-level general capabilities by the end of 2026.
It described that timing as a rough estimate because the benchmark used measures general capability rather than replication directly.
Anthropic said such a system could differ from conventional malware because an AI agent could adapt to unfamiliar hardware instead of relying only on pre-programmed targets. A distributed version could also be harder to eliminate because there would be no single server to shut down, although the researchers estimate early versions would spread slowly.
“We don’t yet have a full rogue replicator,” the researchers wrote, while arguing that models are becoming better at the individual steps required for autonomous propagation.
The researchers said defenses could include monitoring unusual network traffic, quarantining infected devices and strengthening default security standards for internet-connected hardware.
