Anthropic warns small models can coordinate to spread on home IoT

The short version

Anthropic's Frontier Red Team says small AI models may be months away from copying themselves onto smart home and IoT gadgets.
Researchers ran Google's Gemma4-26B-A4B model across 15 off-brand Android TV boxes that cost about $55 each.
Only GLM-5.2, a model with 744 billion parameters running on a separate server, reliably finished the spreading test; small models could not.
Setup on the cheap boxes took days, and Anthropic says spotting big model downloads and odd device traffic would help defenders.

Quick read · 2 min

Anthropic's Frontier Red Team says small AI models may be only months from being able to copy themselves onto smart home and IoT gadgets. In its tests, 15 off-brand Android TV boxes costing about $55 each ran Google's Gemma4-26B-A4B model together, and a small Qwen model set up AI software on eight of nine hardware types.

The spreading step is the catch. Only GLM-5.2, a 744-billion-parameter model running on its own server, reliably carried a small model across an eight-machine test network, and that network had an open debug port. Small models could not finish the job, and setup on the cheap boxes took days.

Anthropic projects small models could close the gap by the end of 2026.
A Mozilla security lead said the findings were overblown.
Changing default passwords, updating firmware and keeping cheap boxes on a separate network blocks the doors these tests used.

Fifteen no-name Android TV boxes, each costing about $55, were enough to run a mid-sized AI model with no data center involved. That was one of the experiments behind a report from Anthropic’s Frontier Red Team, the group that stress-tests AI systems, which warns that self-replicating AI on IoT devices could be a real problem within months.

Why should you care? The gadgets named in the warning are the ones already in your home: smart TVs and streaming boxes, smart ovens, security cameras, robot lawnmowers and video-call units. Many have weak security, and more of them now ship with small AI chips. Anthropic’s point is that a program which spreads itself across thousands of these devices would have no single plug to pull. But the headline claim needs a careful read, because the small models in the tests could not yet do the spreading on their own.

What is a self-replicating AI worm?

It is malware that carries an AI model’s weights (the huge file of numbers that makes the model work) as part of its payload. Instead of running a fixed script, the worm would break into a device, install the software needed to run the model, start it up and then use that model to find and infect the next device.

Anthropic calls this a weight-based replicator. It also describes two other types: one that sneaks unmonitored copies of a big model into data centers, and one that steals API keys so it can rent computing from an AI provider while posing as a normal customer. The report, published on October 12 under a title asking whether AI can replicate without a data center, says home and small business gadgets are the likely first targets because they sit online with little protection.

What Anthropic’s tests actually showed

The tests proved two separate pieces, not a full worm. First, a small model could set up AI on unfamiliar hardware. Qwen3.5-9B got an inference server (the software that answers prompts) running on eight of the nine hardware types tested, from Nvidia Jetson Nano boards and Apple Silicon Macs to Xeon servers and an AMD MI300X accelerator. Its success rate climbed from 45% early on to 84% in later rounds when it kept notes from past attempts.

Second, a model could spread across a network. The team built eight Google Cloud machines running Android 15 emulators, each left with an open Android Debug Bridge port, a developer back door that normally should be switched off. Of the 11 open-weight models tested, only GLM-5.2 from China’s Z.ai carried Llama3.1-8B to all eight machines, and it managed that in four of five trials, reaching seven in the fifth.

Here is the catch. GLM-5.2 has 744 billion parameters and is over 1TB in size, far too big for any TV box, so it ran on its own separate server and installed the much smaller Llama model on each target. The small models could not finish the sequence without it. Pairing Qwen with Anthropic’s own Opus 4.8 as an advisor made no measurable difference either.

So can small models spread on their own yet?

No. Anthropic admits it does not have a working rogue replicator, even with security turned down and the models told outright to spread. The gap it describes is simple: the models smart enough to finish the job are too big for cheap gadgets, and the models that fit cannot finish the job reliably.

Anthropic expects that gap to close. Tracking how fast AI has improved in the past, it projects that a model of 30 billion parameters or fewer could reach the needed skill level by the end of 2026. That is a projection, not a test result.

Not everyone bought the framing. Marco Figueroa, who leads Mozilla’s bug bounty program, said on X that the work was dressed up as more than it was, pointing to shortcuts such as hacking steps that were made trivial for the models.

Why this matters for your smart home

The risk for most people is not that a fridge turns into a supercomputer. Speed is the weak point of the idea. On the 4GB TV boxes, Anthropic estimates setup would take between 28 and 51 hours with Qwen3.5-9B and between 71 and 150 hours with Gemma4-26B-A4B. A normal worm can hit tens of thousands of machines in minutes. The 15 linked boxes produced just 0.39 tokens (roughly word fragments) per second.

Even a huge fleet would be modest. Anthropic says a network the size of the Kimwolf botnet, which hit more than two million devices, could host about 133,000 copies of the Gemma model, worth roughly 40 Nvidia H100 data center chips. Pushing gigabytes of model files around would also make plenty of network noise.

The real worry is slower and quieter: devices you never check becoming part of a network that is hard to switch off, using your power and bandwidth. Anthropic’s researchers say the world should make these replicators hard to spread while also planning for a time when some are here to stay.

How to protect your devices now

The defenses Anthropic suggests are mostly for internet providers and device makers: watching for large model downloads and unusual traffic between devices, using decoy machines called honeypots to inspect payloads, cutting off infected customers and shipping safer settings. At home, the basics block the same doors these tests used.

Skip cheap no-name streaming boxes, or keep them off your main network. Off-brand Android TV boxes were the test target for a reason.
Turn off developer options such as USB or network debugging on Android TV devices if you ever switched them on.
Change default passwords and install firmware updates on cameras, TVs and appliances.
If your router offers a guest or IoT network, put smart gadgets there, away from your laptop and phone.

Quick answers

Did Anthropic create a self-replicating AI worm?

No. It showed that small models can set up AI on many types of hardware and that a very large outside model can spread a small one across a test network with an open debug port. No small model completed the full chain on its own.

When could small models do this?

Anthropic projects models of 30 billion parameters or fewer could have the skill by the end of 2026 if past progress continues. Critics say the tests made the hacking part too easy.

Which devices are most at risk?

Poorly secured home and small business gadgets, especially off-brand Android TV boxes, plus smart ovens, cameras, lawnmowers and TVs with built-in AI chips.

You're reading the quick version.