Anthropic researchers warn that small AI models could be just months away from autonomously replicating across internet-connected IoT devices, including smart TVs, ovens and other household electronics, without relying on centralized data centers, according to new research.
In testing, a 9-billion-parameter AI model successfully ran on eight of nine hardware types, while models with 30 billion parameters or fewer completed many individual steps required for self-replication. Researchers also demonstrated a 26-billion-parameter model operating across 15 inexpensive Android TV boxes.
Anthropic warned that AI-powered worms could exploit poorly secured IoT devices, adapt to unfamiliar hardware, spread without human intervention, unlike traditional malware relying on centralized infrastructure, these distributed AI systems could be difficult to shut down.
Researchers said current models cannot yet reliably complete the full replication process on tested IoT hardware, but that capability could emerge within months.
John Strand, Owner, Black Hills Information Security:
“We are now firmly in the land of science fiction. Unfortunately, it’s not fiction. We’ve been looking at self-replicating worms and botnets like Carna for decades. The concern has always been their ability to spread. What makes this different is that AI has the capability to identify vulnerabilities, exploit them automatically, and then replicate across devices, instead of relying on an existing vulnerability.
“The biggest takeaway is that smaller models have many of the same capabilities as cutting-edge frontier models. They just take longer. When you see reports about high-end research models like Mythos, understand that smaller models running on systems with around 128 gigabytes of memory are still in the ballpark. They may not be as good or as fast, but defenders have to be ready for them.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:
“Anthropic’s research highlights an interesting shift in the threat landscape. We’ve spent years worrying about securing IoT devices, and now we’re exploring a future where your smart TV might do more than recommend what to watch. It could become part of a distributed, autonomous attack infrastructure. That’s quite an upgrade, and not one I’d recommend.
“From my experience in offensive security, the question isn’t simply whether an AI model can replicate, but what it can accomplish after gaining a foothold. Can it discover other devices, cross trust boundaries, exploit weaknesses, establish persistence, and continue operating without centralized infrastructure? Those are the attack paths we need to test, not just theorize about.
“Anthropic demonstrated important building blocks, including successful propagation in a simplified, controlled environment using a larger model. But that doesn’t mean smaller models can reliably spread autonomously across real-world IoT environments today. There’s a difference between demonstrating capability and proving operational reliability, and that distinction matters.
“The objective isn’t simply to detect the next AI-powered worm. It’s to understand where our architectures would allow it to spread, validate the controls intended to contain it, and produce evidence that those defenses actually work. After all, the last thing we need is a smart oven that decides lateral movement is part of the recipe.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“There’s a lot of fearmongering about AI escaping containment, hacking its way into resources and then completely losing control over it. The research Anthropic performed on self-replicating AI directly addresses the feasibility of this in IoT devices, as these tend to have low to zero security controls in place, making them an easy target.
“Lets be clear on what self replication means. Because it sounds bad.
“AI uses model weights to function. To replicate to another system it has to 1) access that system remotely, 2) download its own model weights, and 3) setup a loop so the model can prompt itself to go find more hosts to replicate to.
“It needs to be noted that without an orchestration layer, there’s no way to direct the swarm of replicated agents. They’ll just keep executing the same loop indefinitely.
“This concept isn’t new. We call self replicating malware worms. Self replicating AI is then more accurately thought of as a regular worm style malware, that happens to include the ability to download model weights, and then loop prompts and outputs indefinitely, using tool calls to execute functions as needed.
“We’ve had decades to get good at finding and eliminating worms from our networks. Self replicating AI powered malware is just another variant on and old technique.
“However, we’re also still releasing IoT products with effectively no security in them, that are designed to be compromised. Huge portions of IoT devices are already being used as parts of botnets, without their owner’s knowledge or consent.
“Anthropic concluded that models capable enough to self replicate don’t fit onto the limited resources found on IoT devices. They also found that models could be distributed over multiple IoT devices, allowing for more sophisticated models to run on limited hardware. This wouldn’t be self replicating anymore, as it requires an orchestration layer. Although you could simply have the worm run at the orchestration level, but because it requires more resources to run larger models, it would be limited to targeting higher powered systems, which would expose it to more traditional security counter measures, such as EDR.”
ㅤ
John Carberry, Solution Sleuth, Xcape, Inc.:
“Autonomous AI self-replication across enterprise-adjacent Internet of Things (IoT) hardware introduces immediate operational and liability risks by turning unmanaged perimeter devices into decentralized attack platforms without datacenter reliance. Yet self-replicating software is not new. The first was the Christmas Tree worm in 1987, closely followed by the Morris Worm in 1988, both of which wreaked havoc on existing networks, including what we now call the Internet. Anthropic’s research highlights a modern twist through distributed weight sharding across consumer electronics, meaning traditional centralized egress kill switches will fail to neutralize localized infections. Rather than panicking over speculative model autonomy, security leaders must prioritize fundamental architecture: isolate peripheral electronics into segmented subnets, disable unauthenticated management interfaces, and eliminate default credentials before automated propagation becomes viable.”
“Critical Takeaways
- Self-propagating code is an established threat pattern, but sharding model weights across local consumer devices bypasses traditional datacenter-level kill switches.
- The immediate operational vulnerability lies in unpatched remote execution flaws and default administrative credentials on edge hardware, not emergent artificial intelligence.
- Defensive priorities remain architectural: segment peripheral devices into isolated networks and enforce strict access controls to prevent hardware from serving as lateral pivot points.
“We spent nearly four decades hardening networks against self-replicating worms only to invite them back in through unpatched conference room displays.”
ㅤThis shows that AI can’t be trusted. Which means that you have to gatekeep the daylights out of it if you want to use it. Consider this your 2 minute warning.
Related
This entry was posted on October 13, 2026 at 6:12 pm and is filed under Commentary with tags Anthropic. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Anthropic warns AI could self-replicate across IoT devices within months
Anthropic researchers warn that small AI models could be just months away from autonomously replicating across internet-connected IoT devices, including smart TVs, ovens and other household electronics, without relying on centralized data centers, according to new research.
In testing, a 9-billion-parameter AI model successfully ran on eight of nine hardware types, while models with 30 billion parameters or fewer completed many individual steps required for self-replication. Researchers also demonstrated a 26-billion-parameter model operating across 15 inexpensive Android TV boxes.
Anthropic warned that AI-powered worms could exploit poorly secured IoT devices, adapt to unfamiliar hardware, spread without human intervention, unlike traditional malware relying on centralized infrastructure, these distributed AI systems could be difficult to shut down.
Researchers said current models cannot yet reliably complete the full replication process on tested IoT hardware, but that capability could emerge within months.
John Strand, Owner, Black Hills Information Security:
“We are now firmly in the land of science fiction. Unfortunately, it’s not fiction. We’ve been looking at self-replicating worms and botnets like Carna for decades. The concern has always been their ability to spread. What makes this different is that AI has the capability to identify vulnerabilities, exploit them automatically, and then replicate across devices, instead of relying on an existing vulnerability.
“The biggest takeaway is that smaller models have many of the same capabilities as cutting-edge frontier models. They just take longer. When you see reports about high-end research models like Mythos, understand that smaller models running on systems with around 128 gigabytes of memory are still in the ballpark. They may not be as good or as fast, but defenders have to be ready for them.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security Technology Inc.:
“Anthropic’s research highlights an interesting shift in the threat landscape. We’ve spent years worrying about securing IoT devices, and now we’re exploring a future where your smart TV might do more than recommend what to watch. It could become part of a distributed, autonomous attack infrastructure. That’s quite an upgrade, and not one I’d recommend.
“From my experience in offensive security, the question isn’t simply whether an AI model can replicate, but what it can accomplish after gaining a foothold. Can it discover other devices, cross trust boundaries, exploit weaknesses, establish persistence, and continue operating without centralized infrastructure? Those are the attack paths we need to test, not just theorize about.
“Anthropic demonstrated important building blocks, including successful propagation in a simplified, controlled environment using a larger model. But that doesn’t mean smaller models can reliably spread autonomously across real-world IoT environments today. There’s a difference between demonstrating capability and proving operational reliability, and that distinction matters.
“The objective isn’t simply to detect the next AI-powered worm. It’s to understand where our architectures would allow it to spread, validate the controls intended to contain it, and produce evidence that those defenses actually work. After all, the last thing we need is a smart oven that decides lateral movement is part of the recipe.”
ㅤ
Steven Swift, Managing Director, Suzu Labs:
“There’s a lot of fearmongering about AI escaping containment, hacking its way into resources and then completely losing control over it. The research Anthropic performed on self-replicating AI directly addresses the feasibility of this in IoT devices, as these tend to have low to zero security controls in place, making them an easy target.
“Lets be clear on what self replication means. Because it sounds bad.
“AI uses model weights to function. To replicate to another system it has to 1) access that system remotely, 2) download its own model weights, and 3) setup a loop so the model can prompt itself to go find more hosts to replicate to.
“It needs to be noted that without an orchestration layer, there’s no way to direct the swarm of replicated agents. They’ll just keep executing the same loop indefinitely.
“This concept isn’t new. We call self replicating malware worms. Self replicating AI is then more accurately thought of as a regular worm style malware, that happens to include the ability to download model weights, and then loop prompts and outputs indefinitely, using tool calls to execute functions as needed.
“We’ve had decades to get good at finding and eliminating worms from our networks. Self replicating AI powered malware is just another variant on and old technique.
“However, we’re also still releasing IoT products with effectively no security in them, that are designed to be compromised. Huge portions of IoT devices are already being used as parts of botnets, without their owner’s knowledge or consent.
“Anthropic concluded that models capable enough to self replicate don’t fit onto the limited resources found on IoT devices. They also found that models could be distributed over multiple IoT devices, allowing for more sophisticated models to run on limited hardware. This wouldn’t be self replicating anymore, as it requires an orchestration layer. Although you could simply have the worm run at the orchestration level, but because it requires more resources to run larger models, it would be limited to targeting higher powered systems, which would expose it to more traditional security counter measures, such as EDR.”
ㅤ
John Carberry, Solution Sleuth, Xcape, Inc.:
“Autonomous AI self-replication across enterprise-adjacent Internet of Things (IoT) hardware introduces immediate operational and liability risks by turning unmanaged perimeter devices into decentralized attack platforms without datacenter reliance. Yet self-replicating software is not new. The first was the Christmas Tree worm in 1987, closely followed by the Morris Worm in 1988, both of which wreaked havoc on existing networks, including what we now call the Internet. Anthropic’s research highlights a modern twist through distributed weight sharding across consumer electronics, meaning traditional centralized egress kill switches will fail to neutralize localized infections. Rather than panicking over speculative model autonomy, security leaders must prioritize fundamental architecture: isolate peripheral electronics into segmented subnets, disable unauthenticated management interfaces, and eliminate default credentials before automated propagation becomes viable.”
“Critical Takeaways
“We spent nearly four decades hardening networks against self-replicating worms only to invite them back in through unpatched conference room displays.”
ㅤThis shows that AI can’t be trusted. Which means that you have to gatekeep the daylights out of it if you want to use it. Consider this your 2 minute warning.
Share this:
Like this:
Related
This entry was posted on October 13, 2026 at 6:12 pm and is filed under Commentary with tags Anthropic. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.