Anthropic says small artificial-intelligence models may be approaching the technical capability needed to copy themselves across networks of inexpensive internet-connected devices. The company’s Frontier Red Team published controlled experiments on October 12 showing that current models can already perform many parts of an autonomous replication chain. The work does not demonstrate an AI system escaping onto the public internet, and the researchers deliberately simplified important security barriers.
The study examined a scenario in which a model would find a target device, gain execution, install an inference system and continue spreading from the new host. Anthropic focused mainly on the difficult inference-setup stage rather than discovering and exploiting real-world vulnerabilities. Its test environment used a firewalled network of eight cloud nodes with an unauthenticated Android Debug Bridge port, making initial access much easier than it would normally be.
What the experiments found
Anthropic reported that a nine-billion-parameter model successfully set up inference on eight of nine hardware types tested. Models with 30 billion parameters or fewer could complete many individual replication tasks, although they often failed when trying to combine every step into one reliable sequence.
In the simplified end-to-end evaluation, GLM-5.2 was the only tested open-weight model to complete the full replication process. It reached all eight nodes in four of five trials and seven nodes in the remaining trial. The researchers used the larger model to install and propagate a smaller Llama 3.1 8B payload, so the result does not show GLM-5.2 literally copying its own full weights across the test network.
The company also demonstrated that a 26-billion-parameter model could run in distributed form across 15 inexpensive Android TV boxes, each with limited memory. Anthropic argued that future malicious systems could combine the computing power of poorly secured smart-home or small-business devices instead of relying on a single data-center GPU.
A warning, not a real-world outbreak
Reuters reported that cybersecurity experts were divided over the significance of the work. Ciaran Martin, a former head of Britain’s National Cyber Security Centre, described the research as technically interesting but said the accompanying warning showed signs of vendor exaggeration. Other specialists said the controlled conditions should not erase the underlying concern that an adaptable AI worm might behave differently from conventional malware.
The distinction matters. Anthropic’s environment removed authentication from the port used to enter each node, and the study did not test an autonomous system breaking through hardened commercial devices across the open internet. The researchers described their result as an upper bound on real-world success rather than proof that such a botnet can already spread in ordinary conditions.
Anthropic nevertheless argued that the capability gap may narrow quickly. If small models continue improving at their historical pace, the company estimates they could reach the level demonstrated by the strongest tested system before the end of 2026. That is a projection based on past progress, not a confirmed timetable.
Why IoT devices are part of the risk
Many low-cost connected devices run outdated software, receive limited security support and remain online for long periods. A model capable of adapting installation steps to unfamiliar hardware could potentially use those weaknesses while avoiding a single centralized service that defenders could shut down.
The research suggests defensive work should focus on basic device security as well as advanced AI safeguards. Strong authentication, patched firmware, closed debugging ports, network segmentation and monitoring for unusual model files or inference workloads would reduce the opportunities described in the study.
For now, the finding is best understood as an early technical warning. It shows that several building blocks of autonomous replication are becoming available, while leaving major questions about exploitation, persistence, speed and real-world reliability unresolved.
