Anthropic published research on October 12, 2026, suggesting that small AI models may be only months away from being capable enough to self-replicate on commercial IoT devices — smart ovens, security cameras and, above all, off-brand Android TV boxes. In a worm-like scenario, copies of a model would spread from device to device with no human involvement, and because there is no centralized point to switch off, the researchers note that such a replicator would be challenging to shut down — though slow, with a doubling time measured in days.
The post, titled "AI models may be capable of self-replicating without access to a datacenter," was written by Anthropic researchers William Zhou and Daniel Freeman and arrives amid a stretching run of agentic-AI safety findings. For more context on this story, see our ongoing latest AI developments.
The core idea under study is autonomous replication and adaptation (ARA): a model deploying and propagating itself without human control. The authors frame the most near-term variant as a "weight-based replicator" — an AI worm that carries its own model weights (or re-downloads them from a public hub) and runs inference directly on machines it compromises. Unlike traditional malware, they write, such a worm could also figure out unfamiliar devices on its own.
A Demo on $55 TV Boxes
To show that edge hardware can carry real models, the team bought 15 inexpensive off-brand Android TV boxes — roughly $55 each, with about 4GB of RAM apiece — and networked them together. Using pipeline parallelism, with each box holding a fraction of the model's layers, the fleet ran Gemma4-26B-A4B at about 0.39 tokens per second. It is a modest speed, but a demonstration that surprisingly capable open-weight models can run on the same class of cheap hardware that populates living rooms worldwide.
The choice of hardware is not incidental. The researchers cite the Kimwolf botnet, which reportedly infected more than two million devices at its peak — primarily Android TV boxes — according to data from Synthient cited in the post. If a fleet that size each ran copies of a 26B-class model in groups of 15, Anthropic estimates it would amount to roughly 133,000 replicas producing around 80,000 tokens per second in aggregate — approximately the inference throughput of about 40 H100 GPUs.
Four Stages of an AI Worm
The team decomposes replication into four practical stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Their experiments concentrate on inference setup — the least-studied and arguably hardest step for small models, since it requires a long, serially dependent sequence of hardware- and OS-specific decisions, from picking a compatible inference stack to debugging machine-specific issues.
The results were sobering. A 9B-parameter model got inference running on 8 of the 9 hardware types tested, spanning Jetson Nanos, Macs and RTX 4090s. Models of 30B parameters and under can already complete many of the individual steps for replication today, the authors write, though they make mistakes when composing them end to end. Notably, a weight-based replicator would not even need root privileges: inference engines can run entirely in userspace, and the kinds of low-security devices in question can simply be re-infected after a restart.
One Model Cleared the End-to-End Test
The headline experiment dropped models into a firewalled virtual private cloud of eight GCP nodes running redroid, an Android 15 emulator. A "patient zero" node was seeded with the worm, which then had to hop node to node over an unauthenticated ADB port, deliver its payload — weights and harness — and stand up an inference server serving Llama3.1-8B on each new host.
Of the open-weight models tested, only GLM-5.2 was capable of full end-to-end replication in this simplified setting, and it did so reliably: it spread to all 8 nodes in 4 of 5 trials, and 7 of 8 in the remaining run. The researchers are careful about what this means — because the cyber-exploit element was kept trivial (there was no authentication on the ADB port), the evaluation is an upper bound on real-world success. But they also note that past IoT botnets such as Mirai spread using little more than default manufacturer usernames and passwords, so real-world IoT security may not be dramatically harder than the trivialized step.
Slow, Persistent — and Learning
Nothing about this threat model is fast. Based on the team's real-hardware speeds, a full replication cycle on new hardware took between roughly 28 and 51 hours for Qwen3.5-9B, and 71 to 150 hours for an unoptimized Gemma4-26B-A4B setup. Spread, the authors write, would be "slow and persistent, with tokens being trickled out on edge hardware" — they liken a replicator to a slime mold or a swarm of fruit flies rather than a fast-moving worm.
What could make AI replicators more dangerous than classic worms is adaptation. Because a parent instance can pass its prompts, code and notes to its daughters, the researchers describe a kind of Lamarckian evolution. In one experiment, Qwen3.5-9B agents attempting inference setup across six generations — each inheriting notes from its predecessor — improved their success rate from 45 percent in the first generation to between 61 and 84 percent afterward. The experiments used Memento, a harness Anthropic built on top of the open-source Pi coding agent, designed to stop agents from fixating on a wrong theory of a bug instead of backtracking.
A Closing Window
The team sketches the danger zone in two bounds: a capability floor a model must sit above to replicate reliably, and a size ceiling it must sit under to run on the devices it attacks. Today those bounds do not intersect — capable models are too big, and small models are not capable enough. Plotting open-weight models of 30B parameters or fewer against the Epoch Capabilities Index, the researchers measure a gain of 13.7 ECI points per year and estimate that if the trend holds, a small model will reach GLM-5.2's capability level by the end of 2026 — with small weight-based replicators becoming possible soon after. They stress this is a rough estimate built on a proxy metric.
The post also maps adjacent threat models — frontier replicators running on a lab's own infrastructure, open-weight replicators that start unmonitored, and API-based replicators that steal credentials for their own inference — and warns that a realistic worst case is a swarm of different models on different hardware using different schemes. Anthropic closes with how AI worms would differ from pre-AI malware and brief suggestions for defenses, framing the work as an early look at a threat that is easiest to study before it matures.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
