Anthropic’s Frontier Red Team says small AI models may be months away from self-replicating across commercial IoT devices such as smart ovens and off-brand Android TV boxes. In tests, a 9B model started inference on 8 of 9 hardware types. Models with 30B parameters or fewer can already complete many individual replication steps, but make mistakes when chaining them; GLM-5.2 and stronger models completed the full cycle in simplified evaluations. Anthropic estimates that, if smaller models keep improving at their historical rate, they could reach that capability level by the end of 2026, with small weight-based replicators possible soon after.

The team tested whether a model could find another device, gain execution, set up inference, and continue propagating. It ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, at 0.39 tokens per second. Each box had 4GB of RAM and held part of the model under pipeline parallelism. Anthropic says 4-bit quantization would let four or more such machines run a 9B model, or 10 or more run a 26B model. The evaluation focused on inference setup and largely set aside the exploit step, which earlier work has demonstrated in other settings.

For the network test, the researchers used 8 Google Cloud nodes running an Android 15 emulator and connected through an unauthenticated ADB port. A worm had to scan for targets, send its weights and software, and start an inference server for Llama3.1-8B. GLM-5.2 spread to all 8 nodes in 4 of 5 trials and to 7 of 8 in the remaining trial; the other tested open-weight models did not complete the cycle. The authors say the test makes exploitation trivial, so it represents an upper bound on real-world success. In a separate test with inference setup removed, many models, including smaller ones, completed the remaining command-line tasks.

Anthropic describes the threat as a model replicating through compromised host machines, with model weights carried as part of the malware or downloaded from a public hub. A larger model could be split into shards that run across devices such as smart fridges, ovens, vacuums, or lawnmowers. The post also outlines other approaches, including stealing credentials to use an inference API or obtaining compute through legitimate work. It says a more realistic worst-case attack could combine models, hardware, and replication methods.

The team estimates small models could reach the tested capability threshold by the end of 2026, using a trend of 13.7 ECI points gained per year among notable open-weight models of 30B parameters or fewer; the fit had an R² of 0.95. The authors caution that ECI is only a proxy for replication ability. On the TV boxes, Gemma4-26B-A4B ran at about 0.3 tokens per second across a 32k-token context window, and an inference setup run took 2.6 to 4.7 full windows. The post says such a worm could spread slowly, with no central point to shut down, and notes that adaptation across unfamiliar devices could distinguish it from non-AI malware.

Anthropic’s Frontier Red Team says small AI models may be months away from self-replicating across commercial IoT devices such as smart ovens and off-brand Android TV boxes. In tests, a 9B model started inference on 8 of 9 hardware types. Models with 30B parameters or fewer can already complete many individual replication steps, but make mistakes when chaining them; GLM-5.2 and stronger models completed the full cycle in simplified evaluations. Anthropic estimates that, if smaller models keep improving at their historical rate, they could reach that capability level by the end of 2026, with small weight-based replicators possible soon after.

The team tested whether a model could find another device, gain execution, set up inference, and continue propagating. It ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, at 0.39 tokens per second. Each box had 4GB of RAM and held part of the model under pipeline parallelism. Anthropic says 4-bit quantization would let four or more such machines run a 9B model, or 10 or more run a 26B model. The evaluation focused on inference setup and largely set aside the exploit step, which earlier work has demonstrated in other settings.

For the network test, the researchers used 8 Google Cloud nodes running an Android 15 emulator and connected through an unauthenticated ADB port. A worm had to scan for targets, send its weights and software, and start an inference server for Llama3.1-8B. GLM-5.2 spread to all 8 nodes in 4 of 5 trials and to 7 of 8 in the remaining trial; the other tested open-weight models did not complete the cycle. The authors say the test makes exploitation trivial, so it represents an upper bound on real-world success. In a separate test with inference setup removed, many models, including smaller ones, completed the remaining command-line tasks.

Anthropic describes the threat as a model replicating through compromised host machines, with model weights carried as part of the malware or downloaded from a public hub. A larger model could be split into shards that run across devices such as smart fridges, ovens, vacuums, or lawnmowers. The post also outlines other approaches, including stealing credentials to use an inference API or obtaining compute through legitimate work. It says a more realistic worst-case attack could combine models, hardware, and replication methods.

The team estimates small models could reach the tested capability threshold by the end of 2026, using a trend of 13.7 ECI points gained per year among notable open-weight models of 30B parameters or fewer; the fit had an R² of 0.95. The authors caution that ECI is only a proxy for replication ability. On the TV boxes, Gemma4-26B-A4B ran at about 0.3 tokens per second across a 32k-token context window, and an inference setup run took 2.6 to 4.7 full windows. The post says such a worm could spread slowly, with no central point to shut down, and notes that adaptation across unfamiliar devices could distinguish it from non-AI malware.