Anthropic research: small open-weight AI models may be months from self-replicating across cheap IoT devices; a 9B model set up inference on 8 of 9 hardware types, and GLM-5.2 completed end-to-end replication in simplified tests
Anthropic published research on 12 October 2026 warning that small AI models may soon be able to copy themselves onto poorly secured internet-of-things devices, such as smart ovens and off-brand Android TV boxes, and run there without a datacenter. It describes this as an AI worm that carries its own model weights, or downloads them again from a public hub, and runs inference on the hardware it has compromised. Anthropic split replication into four stages: finding targets, gaining execution, setting up inference and spreading onward. It focused on the inference step because earlier work already shows small models can exploit systems. In its tests a 9-billion-parameter model got inference running on 8 of the 9 hardware types tried, models of 30B parameters and under could complete many individual steps, and GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations; The Hacker News reports GLM-5.2 was the only one of 11 open-weight models tested to propagate reliably across eight emulated Android nodes. Anthropic also ran Gemma4-26B-A4B split across 15 Android TV boxes (about US$55 each) at 0.39 tokens a second. It estimates small models could reach end-to-end capability by the end of this year at their historical rate of improvement, and says such a worm would be slow (a doubling time of days) but hard to shut down because there is no central point to switch off. This is research, not an observed attack.
- Product
- Small open-weight language models; consumer and small-business IoT devices
- Versions
- n/a — research
- Exploited in Australia?
- unknown
- Patch to
- Nothing to patch. Keep cheap IoT and Android TV boxes off business networks or on an isolated segment, block their outbound access except what they need, replace devices that no longer get firmware updates, and watch for unusual sustained CPU use or large model-weight downloads from IoT segments.
Primary: Anthropic — AI models may be capable of self-replicating without access to a datacenter (12 Oct 2026) · The Hacker News — Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets (13 Oct 2026)