Anthropic Warns ‘AI Worms’ Could Replicate Across Smart TVs, IoT Devices Without Data Centres

Anthropic’s Frontier Red Team has warned that small artificial intelligence (AI) models could soon replicate themselves across consumer electronics, potentially creating decentralised networks of computing power that operate without dedicated data centres.

In a research report published on October 12, Anthropic said its experiments suggest that over the next few months, smaller AI models could develop the capability to autonomously replicate on commercial Internet of Things (IoT) devices.

Such systems could exploit poorly secured devices, install the software needed to run AI models, and propagate to other machines without continuous human intervention.

The researchers demonstrated that a 26-billion-parameter model, Gemma4-26B-A4B, could run inference across 15 inexpensive, off-brand Android TV boxes. Each device had 4GB of RAM, and the distributed model ran at around 0.39 tokens per second.

The experiment illustrates how computing workloads that would typically require specialised infrastructure could be distributed across inexpensive consumer hardware. Instead of running a model on a single powerful server, its components can be split across multiple devices, which communicate to execute the workload collectively.

However, running a model across these devices is only one part of the challenge. An autonomous ‘AI worm’ would also need to identify potential targets, gain access, transfer its payload, configure inference on the new hardware, and repeat the process.

In a separate, controlled experiment, the researchers used a network of Google Cloud Platform nodes running Android 15 emulators. 

The nodes simulated a replication environment, allowing the team to evaluate whether a model could move between machines through unauthenticated debugging ports and establish inference on a target.

Anthropic reported that GLM-5.2 and stronger models could complete the end-to-end replication process in its simplified evaluation. The experiment does not establish that an uncontrolled AI worm has already spread across consumer devices in the wild.

The team also evaluated models' ability to configure inference on unfamiliar hardware. Qwen3.5-9B successfully established inference across eight of nine hardware types tested, highlighting how AI systems could adapt their software to different computing environments rather than relying on a fixed installation process.

This ability could make future AI worms more adaptable than conventional malware, which typically depends on predefined exploits and instructions. An AI-driven system could potentially troubleshoot failed installations, modify its approach, and keep trying to propagate across different devices.

Anthropic warned that a self-replicating AI system would not necessarily need access to data centre GPUs to sustain itself. Internet-connected devices such as smart televisions, ovens, robot vacuums, and other appliances could provide the computing resources needed to run model components.

The report describes a potential threat model in which a model carries its own weights—the numerical parameters required for inference—as part of the malware payload. If a model is too large to fit on an individual device, its weights could be divided across multiple machines.

This distributed architecture could make containment more difficult because the network would have no single central server that defenders could disable to stop the entire system. Anthropic expects such replication to be relatively slow, potentially taking days for the network to double in size, rather than spreading instantaneously.

Anthropic found that models with 30 billion parameters or fewer can already complete many of the individual tasks needed for autonomous replication, although they still make mistakes when combining the steps into a complete process.

Based on the historical improvement rate of smaller open-weight models, the researchers projected that models capable of completing the full replication process could emerge by the end of 2026. 

Anthropic said the challenge will require defenders to strengthen security across consumer and enterprise devices while preparing for systems that may be difficult to eliminate once they have spread.