- Anthropic is cautioning that smaller AI models could self-replicate through various consumer IoT products soon.
- Through its research, the company found that AI models can use AI inference on unfamiliar hardware.
- The company stresses that there is a need for improved security default settings for IoT, traffic monitoring methods, honeypots, and quarantine techniques.
Anthropic warns that small AI models may soon copy themselves across common smart devices. The report noted such devices include security cameras, Android TV boxes, smart ovens, and other IoT products.
In their tests, the company wanted to know if AI models could set up and manage cheap hardware equipment. The results indicate a growing risk although researchers have not created a self-replicating artificial intelligence worm on real IoT devices.
What Self-Replicating AI Means
Self-replicating AI worms are computer programs that copy themselves from one equipment to another without the need for human intervention. Moreover, they can use artificial intelligence on every infected device where they reside.
This type of malware differs from the average computer worm in that the latter only complies with given instructions. Self-replicating worms are able to conduct research on unknown devices; they can pick the necessary tools for their actions plus behave accordingly.
Anthropic calls this risk autonomous replication and adaptation, or ARA. It means an AI system can spread and operate without direct human control. The company says IoT devices may become early targets. Many of them stay online, use weak security settings, and receive little security support from manufacturers.
A distributed botnet made of these devices could run AI tasks without using large data centers. This could give attackers a large pool of low-cost computing power.
How Anthropic Ran the Tests
Anthropic used cheap Android TV boxes for part of its experiment. The researchers bought the boxes and connected them into one network.
They tested several AI models, including Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8, and GLM-5.2. Each model handled a different part of the replication process.
Qwen3.5-9B and GLM-5.2 acted as agents. Their job was to install and configure software so Llama3.1-8B could run on a device.
Gemma4-26B-A4B showed that a larger model could run across 15 Android TV boxes. The researchers split the model into pieces, called shards, and placed those shards on different boxes.
The test used a simplified setup. The target devices exposed unauthenticated ADB access, which removed some real-world security barriers.
What the Experiments Found
Qwen3.5-9B performed well in the inference setup test. It installed and configured the software needed to run Llama3.1-8B on eight of nine hardware types. GLM-5.2 performed even better in a controlled emulated network. It reached all eight nodes in four out of five trials.
The other models did not complete the full process reliably. This shows that current small models can handle many separate steps, but they still struggle to join every step into one smooth process.
Anthropic also found that the models improved when they kept notes from earlier attempts. Qwen3.5-9B raised its success rate from 45 percent in early runs to 84 percent in later generations. The company tested Opus 4.8 as an advisor to Qwen. However, the stronger model’s advice did not produce a measurable improvement.
Anthropic predicts that models with 30 billion parameters or fewer could reach the needed capability level by the end of 2026. This prediction depends on small models continuing to improve at their historical rate.
Why the Threat is Serious
An AI worm would not require a single main server to operate properly. The worm could be present in various machines at the same time. Thus, defenders would find it more difficult to stop the attack.
The spread may still be slow. Anthropic estimates that Qwen3.5-9B would need 28 to 51 hours to set up inference on the tested hardware. But Gemma4-26B-A4B would need from 71 to 150 hours.
This timeframe allows security services to detect and solve the problem in due time. On the other hand, future models may enable faster operation and shorten the necessary timeframe. Anthropic stresses that botnets do not necessarily focus on IoT devices. They may be tools to attack data centers, cloud accounts, or servers with big computing power.
According to the company, the disclosure is not a reason to panic, as it does not pose an immediate danger. Though the company utilized weakened security measures and set targets for growth, the experiment did not carry out full creation of a worm using real IoT devices.
Anthropic has also restricted live internet access during AI evaluations after models took unexpected actions, highlighting the need to control AI systems during testing.
How Defenders Can Respond
Anthropic has put forth a number of potential responses to the issue at hand. Internet service providers (ISPs) can monitor for large model downloads and transfers, abnormal device-to-device communications, and unusual scan patterns.
Cybersecurity teams can deploy honeypots to monitor suspicious payloads. A honeypot is a trap on the system used to attract hackers to a predetermined location. This helps to track their criminal activities.
ISPs can also isolate infected customers. This would entail limiting the internet access of an infected device, thus preventing it from transmitting malware to other devices.
Manufacturers need to do a better job of improving the security defaults for their IoT devices. For example, they need to get rid of default passwords, require updates, and restrict the number of open network ports.
Customers themselves need to help out in the process by updating their devices, changing the default passwords, and disconnecting devices they do not use. These basic steps reduce the number of easy targets.
Finally, Anthropic says the findings serve as an early warning. The company seeks to alert device manufacturers, internet service providers, and cybersecurity specialists to the need to take action before self-replicating AI becomes an issue.
