Imagine a smart TV box in a family’s living room, one of the cheap ones nobody thinks about, quietly becoming part of something bigger. That is the scenario Anthropic’s Frontier Red Team set out to probe in an October 12 report titled “AI models may be capable of self-replicating without access to a datacenter.” The conclusion is more cautious than the headlines it produced: the pieces work in a lab, but they don’t yet add up to a real threat.
What the researchers built
The report looks at a hypothetical kind of malware called a weight-based replicator. Instead of copying ordinary code, it would carry AI model weights along with the software needed to run the model on each device it infects. IoT gadgets are an attractive target, Anthropic says, because they are cheap and poorly defended.
In the first test, Qwen3.5-9B set up an inference server on eight of nine hardware types, including Jetson Nano boards, Apple Silicon Macs, Xeon servers, a Google TPU, AMD’s MI300X and a PC with an RTX 4090. In a second, Gemma4-26B-A4B ran across 15 off-brand Android TV boxes costing about $55 each, producing 0.39 tokens per second together.
A third experiment tested spreading across a network. A seeded agent hopped between eight Google Cloud nodes running Android 15 emulators through an unauthenticated Android Debug Bridge port, moving files and starting an inference server on each. GLM-5.2, a 744-billion-parameter model larger than 1TB, finished the whole sequence on all eight nodes in four of five trials and reached seven in the other, Tom’s Hardware reported.
Where the experiment falls short
The catch is who did the work. GLM-5.2 ran on a separate server because the emulated nodes could not handle it, and what it installed on each target was a much smaller Llama 3.1 8B. No other open-weight model could finish the sequence without GLM-5.2 directing it. So a very large, externally hosted model can orchestrate a simplified spread, and small models can set up inference, but nothing has shown a small model copying itself across consumer hardware alone.
Speed is a problem too. Anthropic estimates that setting up an inference environment on the cheap boxes would take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. A conventional worm can reach tens of thousands of targets within minutes. Multi-gigabyte model payloads and traffic between machines sharing a model would also leave an obvious network signature, which TechRadar noted works in defenders’ favour.
Anthropic compared a hypothetical fleet the size of the Kimwolf botnet, which infected more than two million devices at its peak. If 15 devices hosted each model, such a fleet could support about 133,000 instances of Gemma4-26B-A4B, roughly 40 Hopper H100-equivalents of inference capacity. Tom’s Hardware called the comparison messy and not particularly intimidating.
The worry for later
The gap could narrow. Using the Epoch Capabilities Index, Anthropic projects that a model in the 30-billion-parameter class could reach the needed capability by the end of 2026. The researchers also raise API-based replicators, which would steal human credentials to buy inference from commercial providers, and note that newer devices with built-in AI chips, like security cameras, could become targets.
Defences already exist. Anthropic points to lessons from the Mirai botnet cleanup, including network quarantine, and to rules banning default passwords on IoT devices, as the UK has done. Automatic updates and longer update lifetimes would help against both traditional malware and AI worms.
Sources
- Anthropic warns of self-replicating AI worm threat that doesn't need data centers to self-improve and spread — current deployment is impractical but could become a worry as tech improves
- AI model ‘self-replication’ is only months away, Anthropic says — and it doesn’t even need a data center to happen
