Anthropic: small AI models edging towards self-replication on IoT

Anthropic’s Frontier Red Team has published research on so-called “AI worms”: malware that carries the weights of a language model and runs it directly on the devices it compromises, without relying on a data centre. The researchers conclude that small open-weight models (30 billion parameters or fewer) may be only months away from being capable enough to self-replicate on commercial IoT devices such as cheap Android TV boxes or connected ovens.

The story was covered by SecurityWeek, Security Affairs, The Register, BleepingComputer, The Hacker News, Dark Reading and Ars Technica. This is not a threat in the wild: no complete autonomous replicator has been observed, either in the lab or on the internet. For defenders, the value of the research lies in the figures for each individual step and in the countermeasures.

What the researchers measured

Anthropic breaks replication into four phases: finding targets, gaining code execution, establishing inference on the new device and propagating to other hosts. According to Ars Technica, the agents had access to common exploitation tools such as reverse shells.

• A model spread across cheap hardware. Gemma4-26B-A4B, quantised and split into shards, was run across 15 off-brand Android TV boxes (about $55 each, 4 GB of memory apiece). It works, but at 0.39 tokens per second.
• Setting up inference on unfamiliar hardware. Qwen3.5-9B managed to install and configure inference for Llama3.1-8B on 8 of the 9 hardware types tested, from a Jetson Nano to a Mac. Anthropic considers this the least studied and hardest phase: choosing compatible software, installing dependencies, fixing platform-specific bugs.
• Full cycle. On a closed network of eight emulated Android devices (cloud instances running an Android 15 emulator, according to The Register), only GLM-5.2 completed replication from scratch, propagating Llama3.1-8B to all eight nodes in 4 out of 5 runs (seven out of eight in the fifth). The other open-weight models tested failed reliably; The Register notes that the report does not say how many there were.
• Learning across generations. Each copy leaves the next one notes on what it tried and what did not work. Qwen3.5-9B’s success on a setup task rose from an initial 45% to between 61% and 84% over six generations. Pairing it with a more powerful advisor model (Opus 4.8) brought no measurable improvement.

Timings remain long: for inference setup, BleepingComputer reports 28–51 hours with Qwen3.5-9B (29–51 according to Ars Technica) and 71–150 hours with Gemma4-26B-A4B. The estimated doubling time is days; in 2016 Mirai doubled in roughly an hour.

Limits of the study

The sources agree on several points that put the result in perspective:

• exploitation was made trivial: the targets exposed ADB (Android Debug Bridge) without authentication. Anthropic regards the results as an upper bound on real-world success and points to earlier studies for small models’ ability to exploit vulnerabilities;
• full replication only succeeded with GLM-5.2, which orchestrated the process while a smaller model ran on the targets;
• according to The Register, a purpose-built harness called Memento was also involved.

The Register is the most critical outlet and describes it as a threat that does not exist yet. In Ars Technica, researcher Xiaohan Fu notes that the study does not show that a model would choose to replicate on its own, and calls for the prompts and setups to be published so it can be reproduced.

Anthropic’s projection is conditional: if small models keep improving at their historical rate, they will reach GLM-5.2’s level by the end of 2026, and weight-based replicators “may be possible soon after”.

Why it matters to defenders

The difference from traditional botnets is adaptability. Mirai and Kimwolf (over two million infected devices, mostly Android TV boxes) are written for specific device types and exploits; an AI agent, according to Anthropic, can work out unfamiliar hardware on its own. According to Ars Technica, the weights could travel with the malware or be re-downloaded from a public model hub, becoming part of the payload.

The same traits also make it visible. By the calculation reported by SecurityWeek, a botnet the size of Kimwolf would host roughly 133,000 copies of the 26-billion-parameter model, with combined compute worth at most about 40 Nvidia H100 GPUs. And moving multi-gigabyte files between devices that do not normally talk to each other leaves traces.

Impact for European and Italian businesses

TV boxes, meeting-room displays, cameras, connected appliances: in many companies they sit on the same network as the computers, often with factory credentials. It is the same perimeter that classic IoT botnets already exploit today, and the research does not change the priorities: if anything, it makes them more urgent.

For NIS2 entities, Article 21 requires asset management, vulnerability handling and supply chain security: unmanaged IoT devices are within scope. Anthropic points to manufacturers and regulators as the long-term lever (no default passwords, mandatory firmware updates, stricter certification) and cites the United Kingdom, which has already banned default passwords on IoT devices. In the European Union, the Cyber Resilience Act goes in the same direction, listing secure-by-default configuration among its essential requirements.

What to do now

1. Take an inventory of IoT and consumer devices on corporate networks, including TV boxes and devices brought in by suppliers or staff. Remove off-brand devices or those without updates.
2. Close network ADB (usually on TCP port 5555) and check that it is reachable neither from the internet nor from the internal network.
3. Change factory credentials and disable Telnet and any other unused management services.
4. Segment: put IoT devices on a separate network, with no traffic to servers and, where possible, not even between each other.
5. Filter outbound IoT traffic, allowing only the destinations they need, including downloads from public model hubs.
6. Look for the anomalies the research points to: large file transfers to or from IoT devices, sustained traffic between devices that do not usually communicate, scans originating from an IoT device.
7. Plan for quarantine: in the Mirai clean-up cited by Anthropic, isolating infected subscribers and walking them through clean-up removed 92% of infections within 14 days, against 74% with no notification.

How ARXDOME helps

ARX Watch finds devices without a probe on the network, such as TV boxes, cameras and printers, by listening to DHCP requests and neighbour tables, and alerts you when a new one appears. ARX Expose shows from the outside the open ports and services exposed by mistake, such as ADB reachable from the internet. ARX Sentry brings firewall logs into the SOC pages and the NOC map, with rejected connections and blocked outbound traffic, including that of IoT devices.

Last updated: 14 October 2026