Anthropic warns that small AI models could be months away from copying themselves onto connected devices

Small AI models could be only months from having the ability to copy themselves from one device to the next, the way a computer worm does, on commercial connected hardware such as smart ovens or off-brand Android TV boxes. That is what a set of experiments points to, published on Monday, October 12, by Anthropic's Frontier Red Team.

The first test measures whether such devices have enough power. The researchers bought 15 off-brand Android TV boxes, at about $55 apiece and with 4 GB of memory in each, linked them in a network and ran the Gemma4-26B-A4B model spread across all of them, at 0.39 tokens per second. Each box held a small share of the model's layers. That pace is below the speed of the assistants people chat with.

The least studied part of the process, and the focus of the work, is whether a model can install another one and leave it working on a machine it has never seen. A model with 9 billion parameters managed to start inference on 8 of the 9 kinds of hardware in the test. According to the post, small models such as Qwen3.5-9B can build inference servers on equipment ranging from a Jetson Nano to a Mac or an RTX 4090 card. The researchers left the earlier step, breaking into the device, mostly aside, because previous studies already indicate that small models can exploit security flaws.

In simplified evaluations, some stronger models already carry out replication from start to finish. On a closed network of eight Google Cloud machines emulating Android, GLM-5.2 was the only open model tested that pulled it off: it reached all eight in four of five attempts and seven in the remaining one. Anthropic cautions that the test made getting in easy, since the access port asked for no authentication, so the result is an upper limit on what would happen outside the lab. On top of that, the worm's model was hosted on a separate server, because those machines lacked the capacity to hold it.

For now, the post says, the minimum capability needed to replicate and the maximum size that fits on these devices do not meet in a single model: GLM-5.2 clears the minimum in the simplified evaluation, while Qwen3.5-9B and Gemma4-26B-A4B are the ones that fit on the boxes tested. If small models keep getting better at the pace seen so far, they would get to that level before this year is out, and small replicators might become possible shortly afterwards. Anthropic itself presents this as a rough estimate, because it rests on a general capability index that is only an indirect yardstick.

A replicator of this kind would be difficult to switch off, because there is no central point to disconnect, although it could be slow and need days to double: more than one or two days for each copy of a model with 9 billion parameters, by the authors' reckoning. A fleet as large as Kimwolf, a network of infected devices that passed two million units, would add up at most, running Gemma4-26B-A4B, to the capacity of about 40 H100s, the accelerators used in data centers, an amount the post calls tiny in absolute terms. Unlike traditional malicious software, a model could work out for itself how unfamiliar devices operate.

Anthropic specifies that no complete autonomous replicator exists yet and that the chips it names are not a source of risk or of security flaws. As for defenses, it notes that spreading at scale would leave a trace on the network, because moving models of several gigabytes between devices produces unusual traffic that internet providers can see, and that manufacturers can cut the number of targets with safer factory settings: in the United Kingdom, default passwords on these devices already fall short of the rules.