Anthropic says small AI models may soon replicate on connected devices

The researchers tested whether models could set up inference on unfamiliar hardware. Anthropic says a 9-billion-parameter model completed that task on eight of nine hardware types. The company also says models with 30 billion parameters or fewer could perform many individual replication steps, but made errors when the steps were combined into an end-to-end process.

A separate demonstration showed distributed inference, not infection. Anthropic ran Gemma4-26B-A4B across 15 Android TV boxes, which cost about $55 each, at 0.39 tokens per second. The test showed the boxes could run the model together; it did not show the model copying itself onto them.

Why doesn’t the exercise establish a real-world worm?

For its end-to-end test, Anthropic used eight Google Cloud Platform nodes running Android emulators. Each node had an Android Debug Bridge port without authentication, so the model did not have to break through a security barrier to reach it. The model directing replication ran on a separate inference server because the test nodes could not run the larger models.

Anthropic says GLM-5.2 was the only open-weight model it tested that completed the simplified task. It reached all eight nodes in four of five trials, and seven of eight in the remaining trial. The company says making the entry step trivial means the results are an upper bound on performance in real-world conditions.

The report examined setting up models on hardware but largely left out the cyber-exploit stages needed to find and access real devices. It also did not test whether a model could counter defenders. No independent assessment of the results or the timing projection was identified.

Anthropic projects that small models could reach GLM-5.2’s capability level by the end of 2026 if they continue improving at their historical rate. The company describes this as a rough estimate based on a general capability index, which is a proxy rather than a direct measure of replication ability. The report is a company research post, not an independent evaluation.

What could this mean for connected devices?

Anthropic names smart TVs, ovens, vacuums and security cameras as examples of connected devices that could attract attackers because they may be less well defended than data-center systems. The report does not establish that those device types, or any specific product, are vulnerable to this kind of attack.

The security concern is that compromised devices could provide computing power for a replicator instead of relying on one data center. Anthropic estimates that a hypothetical replicator could have a doubling time measured in days. That is a projection, not a rate observed in real-world spread.

The report separately estimates that setting up inference could take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. Those figures are estimates based on Anthropic’s tests, not measurements of an active worm spreading between devices.

A replicator spread across many devices might not have one central point defenders could shut down, Anthropic says. The company points to unusual network traffic as a possible detection signal and says internet service providers could quarantine devices. Anthropic also says completely eliminating a replicator could require coordination among affected providers.

The evidence so far concerns what models did under simplified conditions, not whether they can independently breach protected consumer or business devices and spread. Anthropic recommends stronger device security; whether the projected capability arrives on its proposed timeline, and can overcome the access and setup barriers left out of the test, remains unestablished.