Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Small AI models may be only months away from being able to self-replicate across commercial IoT devices, without needing a data center, according to research from Anthropic’s Frontier Red Team. The study looks at AI worms that run their own model directly on the devices they compromise. Such malware would be hard to shut down because it has no central point to switch off, though it would likely spread slowly. The researchers bought 15 off-brand Android-based TV boxes for $55 each. A 26-billion-parameter open-weight model split across them ran at 0.39 tokens per second. Rather than exploitation, which prior studies have already examined , the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested. The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs. Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

The study looks at AI worms that run their own model directly on the devices they compromise. Such malware would be hard to shut down because it has no central point to switch off, though it would likely spread slowly. The researchers bought 15 off-brand Android-based TV boxes for $55 each. A 26-billion-parameter open-weight model split across them ran at 0.39 tokens per second. Rather than exploitation, which prior studies have already examined , the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested. The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs. Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

The researchers bought 15 off-brand Android-based TV boxes for $55 each. A 26-billion-parameter open-weight model split across them ran at 0.39 tokens per second. Rather than exploitation, which prior studies have already examined , the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested. The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs. Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Rather than exploitation, which prior studies have already examined , the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested. The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs. Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs. Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials. Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026. “Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

“Small weight-based replicators may be possible soon after,” the company says . Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most 40 Nvidia H100 GPUs, and each replication would take more than a day. [ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

[ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ] Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages. Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool. There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies. Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

More from Eduard Kovacs

Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security

Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own

Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws

Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts

XWorm RAT Evolves Into Surveillance Platform

AI Turns Familiar Cyberattacks Into a Race Against Time

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

Refrigeration Controller Hack Spoils Food Across European Supermarkets

IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Canonical Websites Disrupted in Second DDoS Attack This Year

Flipboard Whatsapp Whatsapp Email