AI giant Anthropic has issued a new warning about the risks posed by increasingly capable AI agents, saying small AI models may be only months away from developing the ability to replicate themselves across internet-connected devices such as smart ovens, TVs and other household gadgets. In a lengthy blog post the company has also cautioned that such systems could be difficult to stop because they would not reply on a centralised data centre and therefore would have ‘no centralised point to shut off’. According to the AI startup’s latest research, these systems could spread across devices such as smart ovens, Android TV boxes and other Internet of Things (IoT) hardware without relying on traditional data centres.The company said such AI-powered replicators would be particularly concerning because they would not have a central point of control. “A replicator like this would be challenging to shut down, since there’s no centralized point to shut off,” Anthropic wrote in its research report, adding that future AI systems could potentially identify and adapt to unfamiliar hardware on their own.
What the tests by Anthropic’s Frontier Red team showed
Android TV boxes, which cost about $55 each. The model ran at a slow 0.39 tokens per second, but it ran. The company noted that such devices often have weak security.In other tests:•A 9-billion-parameter model got inference running on 8 of the 9 hardware types tested.•Models of 30 billion parameters or fewer can already complete many individual replication steps, though they make mistakes when chaining them end to end.•In a simplified test on a network of 8 emulated Android devices, only one model, GLM-5.2, could replicate end to end. It spread to all 8 nodes in four of five trials and to 7 in the other.•If small models keep improving at their historical rate, Anthropic expects them to reach that capability level by the end of 2026.Anthropic cautioned that its test left out much of the hacking work, which makes the result an upper bound on real-world success. It noted, though, that past IoT botnets such as Mirai spread simply by trying default manufacturer passwords.
Anthropic said such a worm would likely spread slowly
Anthropic said such a worm would likely spread slowly, with a doubling time of days, and compared it to a “digital slime mold.” It estimated that a botnet the size of the Kimwolf network, which infected over two million devices, could amount to only about 40 high-end H100 chips’ worth of computing power. Unlike traditional malware, though, an AI worm could work out unfamiliar devices on its own and learn from earlier copies. In one test, the success rate of Qwen3.5-9B at setting up inference rose from 45% in the first generation to between 61% and 84% in later ones, as each copy inherited notes from the last.The company said models too large for a single device could be split into “shards” and run across several machines. Smart fridges, ovens, robot vacuums and lawnmowers could host such pieces. A growing number of devices, including security cameras and conferencing units, also ship with built-in AI chips.
“A future awash with agents”
Anthropic said it is uncertain what form autonomous AI replication will take. It could be a slow, distributed system on insecure devices, a powerful cyber model that breaches data centres at speed, or a model that scams people for computing credits.“As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control,” the company said. It added that slow replicators would be a bellwether for faster, more aggressive ones.
Possible defences
Anthropic said defenders have some advantages. A spreading AI worm would leave a visible network signature, such as multi-gigabyte model downloads and sustained device-to-device traffic. In the Mirai botnet’s case, internet providers cleared 92% of infections within 14 days by quarantining and notifying affected customers. The company also pointed to regulation of default IoT passwords, as in the UK, as a way to shrink the pool of vulnerable devices.
About The Author
