Anthropic researchers warn that small AI models may soon be capable of spreading across inexpensive connected devices without relying on a data center, raising the possibility of autonomous software that would be difficult to eliminate.
In research published October 12, the company’s Frontier Red Team found that models can already perform many of the technical tasks needed to copy themselves onto other machines. The researchers estimate that models small enough to operate on commercial connected devices could achieve the required capabilities by the end of 2026. That projection is not a demonstration of a self-replicating AI worm in the wild.
The findings suggest a potentially different sort of cybersecurity threat: software capable of troubleshooting unfamiliar computers, configuring its own infrastructure and moving between machines without an operator directing every step. Its spread might be slow, but defenders could struggle to find one central system to shut down.
Running AI on television boxes
The researchers, William Zhou and Daniel Freeman, investigated autonomous replication and adaptation, in which a model deploys and propagates itself without human control. Conventional computer worms have copied themselves between computers for decades. An AI-based replicator could add the ability to reason through unfamiliar technical problems.
To test whether consumer hardware could support such software, the team distributed Google’s Gemma4-26B-A4B model across 15 off-brand Android TV boxes costing about $55 each. Collectively, the devices ran the model at approximately 0.39 tokens per second, an extremely slow rate but one that showed expensive data center accelerators are not strictly necessary.
In another set of evaluations, a nine-billion-parameter model managed to establish AI inference on eight of nine hardware types. Inference is the process by which a trained model generates responses. Establishing it on an unfamiliar device can require selecting compatible software, installing dependencies and diagnosing errors specific to that machine.
Testing the replication chain
The researchers then tested a more complete replication process in a firewalled network of eight Google Cloud nodes running an Android emulator. In this controlled environment, an agent was tasked with finding other nodes, transferring a payload and setting up an inference service.
One model, GLM-5.2, reached all eight nodes in four out of five trials and seven nodes in the remaining trial. But the setup deliberately simplified the hardest cybersecurity questions: the devices exposed an unauthenticated debugging port, and the agent’s own larger model ran on a separate inference server. The trial therefore did not show a small model independently infecting and operating on protected real-world devices.
This distinction is crucial. The researchers identified a capability floor, the reasoning and technical competence required to replicate, and a size ceiling, the largest model the target hardware can accommodate. They found that those thresholds do not yet overlap in the devices they studied.
Extrapolating from past improvements in small open-weight models, they estimated that models containing 30 billion parameters or fewer might reach the necessary capability level by the end of this year. They emphasized that the benchmark underlying the forecast is only a proxy for replication ability.
Learning from failed attempts
The study also explored whether successive agent instances could pass on useful knowledge. In an approach called Memento, one instance records what it tried and what failed so its successor can continue with that information. In one experiment involving Qwen3.5-9B, the first generation succeeded 45% of the time, while subsequent generations reached success rates between 61% and 84%.
That result does not mean the models evolved independently or developed intentions of their own. It indicates that a system designed to preserve troubleshooting notes can become more reliable across repeated attempts, a useful property for legitimate automation and a potentially dangerous one for malware.
A slow but persistent threat
Even a successful replicator on household devices would face formidable limits. The researchers estimated that a nine-billion-parameter model could take more than one or two days to replicate on the class of inexpensive hardware they considered. Moving gigabytes of model weights and coordinating distributed inference would also generate network traffic that defenders might detect.
Existing security measures still matter. Better device credentials, network segmentation, monitoring for unusual transfers and quarantine procedures could help contain an outbreak. The authors point to previous efforts against conventional botnets in which internet providers successfully reduced infections by notifying customers and restricting compromised networks.
Still, a replicator distributed across many separately owned devices would present a difficult cleanup problem. Removing it completely might demand coordination among manufacturers, internet providers and device owners, rather than a single action against one cloud service.
The paper does not show that an AI system wants to survive or possesses consciousness. The concern is practical: models given tools and an objective may increasingly be capable of chaining together technical actions that create a self-sustaining cybersecurity problem.
Anthropic’s researchers caution that they have not produced a fully autonomous rogue replicator. They nonetheless see a narrowing gap between the individual capabilities already observed and the coordinated behavior that would be needed.
“We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain,” they wrote.
Source: Anthropic Frontier Red Team research, October 12, 2026.
