Anthropic Warns Small AI Models Are Nearing Self-Replication on Smart Devices

Small AI models are approaching the point where they can act as autonomous digital worms. That is the warning from Anthropic’s Frontier Red Team, in research published on October 12, 2026, reported by Ars Technica and SecurityWeek over the following two days.

The concept is called a “small weight-based replicator.” Instead of calling back to a command-and-control server, the malware carries the model’s weights with it as it reproduces — or re-downloads them from a public hub — and then runs inference directly on the compromised device. Anthropic writes that “effectively, the weights would become part of the malware payload.”

The targets would be the cheapest, least-secured hardware in people’s homes: off-brand Android TV boxes, smart fridges, smart ovens, robot vacuums, lawnmowers, security cameras. These devices are internet-connected, ship with minimal security, and increasingly include on-device AI chips meant to run basic features — chips a replicator could repurpose.

The four stages

Anthropic breaks autonomous replication into four practical stages: finding targets, gaining code execution, establishing inference, and propagating to new hosts. In the tests, the models ran agents with access to common exploitation tools, including reverse shells.

One property sets these apart from traditional worms like Mirai. The replicators can learn on the job: each time one fails to compromise a specific device, it can leave behind prompts, code, and notes so the next copy does not waste time repeating the same ineffective steps.

The hardest stage, the team says, is the one least studied: standing up inference on unfamiliar hardware. That means selecting compatible inference software, installing dependencies, and debugging platform-specific bugs — a long chain of decisions that depends on the specific hardware and software of each target. “These steps are serially dependent, and failures are difficult to recover from,” Anthropic writes.

What the experiments showed

The team bought 15 off-brand Android-based TV boxes for about $55 each. A 26-billion-parameter open-weight model, Gemma4-26B-A4B, split across all 15 boxes managed inference at 0.39 tokens per second — slow, but running.

A 9-billion-parameter model, Qwen3.5-9B, was able to get inference running on eight of the nine hardware types it was tried on.

The full replication cycle was then tested on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed the end-to-end run, reaching all eight devices in four of five attempts.

Anthropic describes these results as an upper bound for real-world success — the lab setup was simplified. Models with 30 billion parameters or fewer can already complete many individual steps but still make mistakes chaining them together. If small models keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s demonstrated ability by the end of 2026, and says “small weight-based replicators may be possible soon after.”

Why it is hard to stop

A replicator spread across thousands of independent, low-cost devices has no centralized point to switch off. Unlike today’s models, which run in data centers where owners can pull the plug, an AI worm distributed across poorly secured home devices would have to be cleaned device by device. The consolation is speed: the tested replication was slow, with an estimated doubling time of days rather than minutes.

Anthropic frames defense in epidemiological terms: drive the replication rate, R₀, below one, so infections die out instead of becoming self-sustaining. Practical measures include the boring basics — eliminating default passwords, the same weakness that let Mirai spread by trying factory credentials — and watching for large model-weight transfers and unusual sustained device-to-device traffic, which could be visible to ISPs.

The company is careful about the scope. It says it has not found evidence of a fully functioning rogue replicator operating outside controlled testing, and did not claim such attacks are underway. “The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication,” the company writes — the threat, in its view, is an unintended byproduct of progress elsewhere.

Others are less sure the threat materializes on schedule. Jessica Ji of the Center for Security and Emerging Technology said it was unclear what would push models to take over consumer hardware in the first place.

The research lands a week after Anthropic’s investor day and a month before its planned late-November IPO pricing window, a reminder that the company’s safety research output and its commercial stakes are scaling together.