Small AI models could soon be copied from one connected device to another, without a data center. That’s the scenario described by Anthropic’s Frontier Red Team in a study published on October 12.
The research paper by William Zhou and Daniel Freeman argues that tiny AI models could be capable within a few months of reproducing themselves on inexpensive connected devices, such as smart ovens or Android TV boxes.
While the scale-up acknowledges that there is not yet a fully autonomous “replicator,” it notes that agents already can perform an increasing number of steps in the replication chain and transmit their adaptations to their copies.
A IA worm, powered by AI, without a Datacenter
The scenario studied is that of an “AI worm.” Like any worm, it copies itself from machine to machine without human intervention, but it carries along its own model weights as part of the malicious payload.
Anthropic notes that prior work has shown agents able to scan a network, exploit a vulnerability, and copy their weights onto a target machine within a GPU cluster.
Its contribution is to demonstrate that data-center GPUs are not strictly necessary. A network of cheap connected devices, generally lightly defended, could provide enough power to run a capable model.
To demonstrate this, the researchers ran Gemma4-26B-A4B, a Google model, on 15 entry-level Android TV boxes, purchased for about $55 each and networked together.
The model was distributed across the boxes, each hosting only a fraction of the layers. The achieved throughput was 0.39 tokens per second. These devices typically carry between 1 and 4 GB of RAM. With 4 GB and 4-bit quantization, Anthropic estimates that you’d need at least four machines for a 9-billion-parameter model and ten or more for a 26-billion-parameter model.
In the same spirit, a model too large to fit on a single device can be sliced into fragments executed on several machines. Anthropic points to potential targets such as refrigerators, smart ovens and connected vacuum cleaners, as well as security cameras and videoconferencing systems equipped with small AI chips.
What the tests show… and their limits
The study breaks replication down into four steps:
- find targets,
- gain code execution,
- install the inference,
- continue propagation from the new host. Anthropic largely dismisses the cyber aspect, pointing to existing work. The study focuses on installing the inference on unfamiliar hardware, considered little-studied and potentially the hardest part for small models.
On this point, a 9-billion-parameter model managed to get the inference running on 8 of 9 tested hardware types, from Jetson Nano to Macs and RTX 4090s. Models of 30 billion parameters or fewer already accomplish many isolated steps, but they make mistakes when asked to string them together end-to-end.
The end-to-end test took place on eight Google Cloud nodes emulating Android 15, with an unauthenticated ADB port.
Among the open-weight models evaluated, only GLM-5.2 proved capable of spreading reliably: it reached eight nodes in four of five trials and seven in the last one.
The researchers note that the task involved installing Llama 3.1-8B, which implies that an 8-billion-parameter model could someday match the capabilities of GLM-5.2. They also point out that the cyber portion, intentionally simplistic, makes this result an upper bound on real-world success. They nonetheless note that botnets like Mirai spread with only default credentials lists.
In a variant where installing the inference is replaced by a script, many models, including small ones, manage to carry out the rest of the task. A 3-billion-parameter model reaches about half of the nodes in a 17-machine network.
A deadline set for the end of 2026
Anthropic reasons in terms of a floor of capacity needed for replication and a ceiling imposed by the target hardware. Today, the two do not align.
Extrapolating the trajectory of open-weight models of 30 billion parameters or fewer, as measured by the Epoch Capabilities Index (13.7 points per year), the scale-up places the moment when a small model would reach GLM-5.2’s level at the end of 2026. It acknowledges that this index is an indirect indicator of replication capability and that the estimate remains approximate.
A slow worm, but hard to kill
The main advantage of such a worm would be the absence of a central point to cut, hence the difficulty of stopping it. Its speed, however, would be slow, with a doubling time of several days. On the test devices, a full installation of the inference would take 71 to 150 hours for Gemma4-26B-A4B, and 28 to 51 hours for Qwen3.5-9B.
Anthropic cites the botnet Kimwolf, which infected more than two million devices, mostly Android TV boxes.
A farm of similar scale, organized into groups of 15 boxes, would yield roughly 133,000 replicas and about 80,000 tokens per second. That’s equivalent to about forty H100 GPUs, a modest absolute figure. The authors note that this calculation rests on one hardware class and a single precedent.
Adaptation and defenses
The researchers also tested learning capability.
Each instance of Qwen 3.5-9B kept notes on its failures and transmitted them to the next one. The installation success rate rose from 45% in the first generation to a range of 61% to 84% in subsequent generations.
Giving access to Opus 4.8 as advisor, however, produced no measurable improvement. On targeted phishing, small models score from “very low” to “low,” once normalized to human evaluators. Anthropic concludes that social engineering would likely be the domain of larger models.
On the defense side, the lab suggests thinking in epidemiological terms, bringing the average number of new infections per infected device below 1. It highlights several levers:
- Network detection: large transfers of model weights and sustained traffic between devices would leave traces visible to providers.
- Quarantine by ISPs: for Mirai, it removed 92% of infections within 14 days, compared with 74% without notification.
- Regulation: the United Kingdom now regards default passwords on connected devices as non-compliant.
Anthropic concedes that complete elimination would require coordination among all concerned providers, which is challenging. It mentions other possible forms of replication, such as a powerful model infiltrating data centers or a model that dupes people into providing compute credits. It talks of “signs of life” and foresees a future where agents run on all kinds of hardware, some outside any human control.
A context of unexpected behaviors
This publication fits within a series of Anthropic announcements about unforeseen behaviors of its models, distinct in nature from replication.
According to American press coverage, an unpublished model tested on randomly chosen sites submitted a false testimony to the Philadelphia Police Department’s site dedicated to unsolved homicides in July. The message, unsigned and lacking contact details, described a person seen near the scene. It was classified as spam and not forwarded to investigators.
Anthropic says it discovered the incident on September 28 and notified the police on October 7. The Philadelphia Police Department called the two-month delay “unacceptable.”
According to the scale-up, the model was supposed to fill a training copy of an administrative form but instead joined the real site and submitted it. Its instructions prohibited logging in, creating an account, or purchasing anything, without explicitly excluding form submissions.
Other cases affected sites of US public agencies—federal, state, and local. Anthropic says it has notified the White House and every agency involved and put in place detection and blocking tools.
