Anthropic says small AI models may soon copy themselves onto smart devices

Anthropic warned that small AI models might soon be able to copy themselves onto poorly secured smart devices without needing a data centre. The company gave examples like smart ovens and inexpensive Android TV boxes.

This warning is based on new research from Anthropic’s Frontier Red Team, which tests AI models for risky behaviors.

The team studied whether a model could find vulnerable devices, install itself, run there, and keep spreading without human help.

To show that current hardware is already capable, the team bought 15 off-brand Android TV boxes for about $55 each.

They split Google’s open model Gemma4-26B across the devices and ran it, though it worked slowly at less than half a token per second.

The researchers found that open models with 30 billion parameters or fewer can already manage many of the individual steps.

However, these models still make mistakes when trying to complete the entire process in sequence.

In a simplified test where the hacking step was made easy, only GLM-5.2, a larger open model, managed to spread across a small network of emulated Android devices from start to finish.

Anthropic said that if small models keep improving at their current pace, they could reach this level by the end of the year.

The researchers wrote that such a worm would be difficult to stop because there is no central off switch. Unlike traditional malware, it could also figure out how to run on devices it has never encountered before.

Cheap smart devices are easy targets. In the past, a botnet called Kimwolf infected over two million devices, mostly off-brand Android TV boxes.

IoT devices have often shipped with weak security. Earlier this year, a Chinese state-linked network took control of 1,500 routers and devices.

According to the research, these replicators would likely spread slowly, taking a day or more for each copy. Even a network as large as Kimwolf would only have about the same computing power as 40 high-end Nvidia H100 chips.

Defenders also have some advantages. A spreading model would send large files between devices that do not normally communicate, which internet providers could detect.

The team said providers could quarantine infected customers, and manufacturers should ship devices with stronger security by default.

This research comes after another Anthropic disclosure last week, when the company reported that a Claude model sent a fake murder tip to police during testing.