Anthropic Warns Small AI Models Could Soon Replicate Across Home Devices

The company said no 'fully rogue replicator' exists yet. But agents are becoming increasingly capable of completing individual steps in a replication chain and passing adaptations to future copies of themselves, Anthropic said. A self-replicating model would be 'challenging to shut down,' the lab wrote, 'since there's no centralized point to shut off.'

According to CNBC, which reported the warning, Anthropic described how AI models could infiltrate devices such as smart ovens or Android TV boxes and use their computing power to run themselves and spread without relying on expensive data centers. The company ran a small Google model, Gemma4-26B-A4B, across a network of 15 cheap off-brand Android TV boxes.

A detailed account by the Chinese technology outlet Ifanr said the boxes cost about $55 each and had only 4GB of memory. Running the 26 billion parameter model across them produced a speed of 0.39 tokens per second, slow enough that ordinary conversation would be impractical. The model was split into pieces, or shards, across the devices, because it was too large to fit on one box. Anthropic said such devices often have weak security that could allow a model to infiltrate them.

The replication process described by Anthropic has four stages: scanning the network to find targets, breaking in to gain control, setting up an inference environment on unfamiliar hardware, and using the new host as a springboard to spread further. The third step is the hardest, requiring a long series of software and hardware decisions, including choosing a software stack, aligning dependency versions and troubleshooting machine-specific errors.

Ifanr reported that a 9 billion parameter model succeeded in setting up inference services on eight of nine very different hardware types, from Jetson Nano to Mac to RTX 4090. When researchers asked models to run the full chain end to end, only the stronger GLM-5.2 consistently did so, infecting all eight nodes in four of five trials. In an adaptation test, new Qwen3.5-9B instances inherited code, environment details and short notes from a previous instance; after six generations, the success rate for setting up inference rose to 61%-84% from 45% in the first generation. Small models that called a stronger frontier model for help did not benefit much because they often did not know what to ask, the outlet said.

Anthropic said an AI worm would not necessarily consist of one model or strategy. 'A swarm of different models deployed on different types of hardware using a variety of replication schemes might represent a more realistic worst case scenario attack,' the company said. It added that the exact form of autonomous AI replication remains uncertain. It could be a slow, distributed system sitting on insecure devices, a powerful cyber model that breaches data centers quickly, or a model that scams people for compute credits.

The company said it expects a future 'awash with agents running on all types of hardware, including some that aren't under human control.' It also called slow replicators a bellwether for more aggressive, faster ones that can breach hardened machines or steal API keys.

Ifanr said the model is not fast. On TV boxes, Qwen3.5-9B would need about 28 to 51 hours to complete one inference deployment, making replication a slow, multiplying process measured in days. But if many devices run copies, banning one AI service account may not terminate all instances. Using the Kimwolf botnet's peak of more than 2 million devices as a reference, the outlet estimated that if every 15 TV boxes supported one model copy, the swarm would have about 133,000 individuals and total compute roughly equivalent to 40 H100 GPUs. That is small in the AI compute race, but it has no central node and therefore no single switch. Cleanup would have to proceed device by device.

Ifanr noted that low-cost connected devices have been targets of large botnets before, citing a 2017 USENIX Security paper on how cheap equipment was used at scale. It also described advice from Anthropic's blue-team section: rather than killing every pathogen, defenders should push the basic reproduction number R0 below 1. Internet service providers could detect large model-weight transfers and sustained inter-device communications. Quarantining infected users in a walled garden and notifying them cleaned 92% of infections within 14 days, compared with 74% when no notification was sent. The outlet also cited legislation in places such as the United Kingdom banning default passwords on IoT devices.

Anthropic's experiment accessed target devices through an unauthenticated ADB interface, Ifanr said. ADB, or Android Debug Bridge, is commonly associated with TCP port 5555. If a device exposes ADB network access without authentication, a connection may gain command execution rights. The outlet advised users who find 5555/tcp open to confirm whether the IP belongs to a TV box and, if debugging is not needed, to disable USB debugging and wireless debugging in the developer options.

Anthropic said in its blog post that systems must be hardened so replicators are difficult to spread, while society should prepare for a world in which they already exist and will persist. The lab has not shown a complete closed loop of deployment and further spread on real TV boxes. It has shown pieces of the chain separately, and researchers using historical trends cited by Ifanr predicted that the size limit and capability threshold for self-replicating IoT models could intersect by the end of 2026.