Self-replicating AI could turn millions of vulnerable smart devices into a distributed intelligence network, and Anthropic's latest experiments suggest the technology is getting dangerously close.

Anthropic Warns AI Could Soon Spread Like a Virus Across Your Smart Devices

AI AI Explained by Julian Vane

Imagine an AI that no longer needs a massive data center to survive. Instead, it spreads across cheap Android TV boxes, security cameras, smart appliances and other internet-connected devices, using their combined processing power to keep itself running. Shutting down the original server would accomplish very little because there might no longer be an original server to shut down.

That scenario sounds like the premise of a particularly unpleasant science-fiction movie. On October 12, 2026, Anthropic published research suggesting that some of the technical ingredients are already within reach.

Its Frontier Red Team, which investigates dangerous capabilities in advanced AI systems, conducted a series of experiments involving inexpensive consumer hardware and simulated networks. In one test, researchers successfully ran a 26-billion-parameter AI model across 15 cheap Android TV boxes. In another, a more powerful AI agent propagated a smaller model through an isolated network of eight simulated Android devices, reaching every device in four out of five attempts.

Anthropic has not created a fully autonomous AI virus capable of spreading through the public internet. What it has demonstrated is that two major obstacles to self-replicating AI—running models on weak hardware and automating the replication process—may be getting smaller.

The distinction matters. The experiments were deliberately simplified, and the most successful replication agent was not running on the TV boxes themselves. But the research raises an uncomfortable cybersecurity question: what happens when an AI can find vulnerable machines, adapt to unfamiliar hardware and deploy new copies of itself without relying on a centralized provider?

Table of Contents

What Anthropic actually discovered about self-replicating AI

Most people encounter artificial intelligence through a relatively simple arrangement. They send a request to a service such as ChatGPT or Claude, powerful computers process it, and the result appears on their screen. The underlying models typically run on infrastructure controlled by companies that can monitor usage, restrict access and disable services.

Anthropic investigated a different possibility: an AI model that carries its own software and model weights from machine to machine, establishing new instances wherever it finds sufficient computing resources.

Model weights are the numerical parameters that encode what a neural network has learned during training. If those weights and the software needed to execute them can be deployed on another computer, the model can potentially run there without contacting its original provider.

Anthropic calls this kind of system a weight-based replicator. The broader concept is autonomous replication and adaptation: an AI system that can reproduce its operational capabilities and adjust to new environments with limited or no human intervention.

For such a system to spread, it needs to accomplish several tasks. It must identify potential hosts, gain sufficient access, configure software that can run the model, and continue the process from newly established machines.

Traditional malware already performs some of these operations. The difficult question is whether an AI can coordinate them independently, especially when different devices have different processors, operating systems, memory limits and software dependencies.

Anthropic’s experiments focused heavily on this last problem. Its researchers wanted to know whether smaller models could install and operate AI software on unfamiliar hardware, then combine those capabilities into a repeating cycle.

Experiment one: Running AI across 15 cheap TV boxes

The first demonstration involved hardware that would look entirely unremarkable in a living room.

Anthropic purchased 15 inexpensive, off-brand Android TV boxes costing approximately $55 each. These devices typically contain modest processors and only a few gigabytes of RAM. Individually, they lack the memory and processing capacity required to run a relatively substantial language model at useful speeds.

But a model does not necessarily have to fit inside one computer.

The researchers divided a model called Gemma4-26B-A4B across the 15 devices. Each box stored and processed a small portion of the neural network, passing intermediate results to the next machine.

This technique, known as distributed inference, allows several limited computers to cooperate on a workload that would be too demanding for any one of them.

It worked.

According to Anthropic’s original research, the network successfully ran the model at approximately 0.39 tokens per second.

For comparison, a token is a small unit of text, often representing part of a word. At 0.39 tokens per second, producing a 100-token response would take more than four minutes, even before accounting for other operational delays.

That is painfully slow by modern chatbot standards.

But speed was not the main point. Anthropic had demonstrated that a model with billions of parameters could operate across a collection of cheap consumer devices rather than inside a conventional AI data center.

There is an important limitation: the researchers purchased, configured and connected these devices themselves. The experiment did not show the model autonomously infecting 15 televisions, discovering vulnerable machines or assembling its own network.

It established that the underlying computation was possible.

That alone changes the range of hardware worth considering in future AI security research. A smart appliance might not be powerful enough to host an entire model, but it could potentially contribute a small fraction of the processing and memory needed by a distributed system.

Experiment two: An AI agent spreads across eight devices

The second experiment addressed a different question: could an AI agent organize the process of spreading from one machine to another?

Anthropic created an isolated network in Google Cloud containing eight nodes running an Android 15 emulator. The environment was deliberately configured to make initial access straightforward, allowing researchers to focus on whether the agent could carry out the subsequent deployment and setup tasks.

The most successful model was GLM-5.2, developed by Chinese AI company Z.ai.

Its assignment was to establish a smaller model, Llama 3.1 8B, on the available machines and continue the replication process through the network.

The results were striking:

  • In four of five trials, GLM-5.2 successfully reached all eight nodes.
  • In the remaining trial, it reached seven of the eight.
  • Other open-weight models evaluated in the same full-cycle test failed reliably.

These findings show that a sufficiently capable agent can coordinate a simplified replication workflow across multiple machines. They do not demonstrate an autonomous outbreak on real consumer hardware.

Crucially, GLM-5.2 itself ran on a separate inference server. The simulated Android devices were not powerful enough to host that larger agent. The experiment therefore used a capable external model to deploy and configure a smaller one.

Anthropic made that choice deliberately. The researchers were testing whether an agent possessed the operational competence required for replication, not whether the same large model could fit on every target device.

The gap between those two capabilities is central to the entire study.

Today’s relatively small models can run on constrained hardware, but they are less reliable at completing complicated replication workflows. More capable models can perform those workflows, but they generally require more computing resources.

A genuinely self-contained AI worm becomes more plausible when a model is simultaneously small enough to run on compromised devices and capable enough to reproduce its own deployment.

Anthropic believes those two thresholds could converge soon. That remains a forecast rather than an observed breakthrough.

What makes an AI worm different from ordinary malware?

Computer worms have existed for decades. They can spread through networks, exploit vulnerabilities and install copies of themselves without requiring a person to approve each new infection.

So why introduce AI at all?

The answer is adaptability.

A conventional worm generally follows instructions written by its developers. It may scan for particular vulnerabilities, target known device types or attempt a predefined sequence of operations. Sophisticated malware can already use multiple techniques and adjust to some environmental conditions, but much of that flexibility must be engineered in advance.

An AI agent could potentially approach an unfamiliar device more like a software engineer confronting a new computer.

It might identify the operating environment, examine available resources, diagnose compatibility problems and select an appropriate way to run its software. The relevant capability is not magical intelligence. It is the ability to reason through technical obstacles that would otherwise require a human operator or additional custom programming.

Anthropic found evidence of this adaptability in its inference-setup evaluations. A nine-billion-parameter model, Qwen3.5-9B, successfully established inference on eight of nine tested hardware types.

The researchers also explored whether successive agent instances could benefit from information left by earlier attempts. In one experiment, later instances inherited notes about previous strategies and mistakes. The initial setup success rate of 45% rose to between 61% and 84% in later generations.

This was not biological evolution or autonomous retraining of the model’s neural weights. The improvement came from passing useful operational context between attempts.

Nevertheless, the implication is interesting. A future AI worm might not need its developer to anticipate every configuration it encounters. It could potentially adapt its deployment strategy as it spreads.

Anthropic has not demonstrated that such a worm could consistently evade defenders or autonomously compromise hardened systems. Those possibilities remain part of the threat model, not established experimental results.

Why losing the data center changes the security problem

Centralized AI infrastructure has obvious vulnerabilities, but it also provides useful points of control.

A model hosted by a commercial provider depends on servers, accounts, networking infrastructure and operational systems that can be monitored or disabled. If a service becomes dangerous, its operator may be able to suspend access or shut down the relevant deployment.

A distributed model running across independently controlled devices creates a different situation.

Imagine that thousands of poorly secured smart devices collectively host many copies of a small AI model. Those copies might communicate over ordinary internet connections, with no single company operating the entire system.

Disabling one machine would remove only part of the network. Disconnecting a server might not affect copies already established elsewhere.

That does not make the system impossible to stop. Internet service providers, device manufacturers, security researchers and network operators can still detect suspicious activity, isolate compromised machines and coordinate cleanup.

But it removes the convenience of having one obvious place to intervene.

Anthropic examined the potential scale using Kimwolf, a botnet reported to have compromised more than two million devices, primarily Android TV boxes.

In a hypothetical network of comparable size, with every 15 boxes collectively hosting one copy of Gemma4-26B-A4B, researchers estimated approximately 133,000 model replicas.

That sounds enormous, but the computational capacity would remain relatively modest. Anthropic estimated the entire fleet could deliver inference throughput equivalent to at most roughly 40 Nvidia H100 GPUs under the assumptions used in its comparison.

In other words, millions of cheap devices would still struggle to match a relatively small amount of modern data-center hardware.

The danger is therefore not that a few compromised television boxes could suddenly outperform the world’s largest AI laboratories. It is that a sufficiently capable system might persist across a large collection of machines, adapt to different environments and become difficult to eliminate completely.

The enormous limitations of Anthropic’s experiments

The research is provocative, but several qualifications are essential before anyone starts worrying about their refrigerator developing an independent agenda.

First, the researchers instructed the agents to carry out replication-related tasks. The experiments did not reveal an AI spontaneously deciding to escape its infrastructure or reproduce against the wishes of its operators.

Second, the most successful end-to-end test took place in an isolated, simplified environment. Access to the simulated devices was deliberately easy, with no authentication protecting the relevant debugging interface.

Anthropic explicitly describes this setup as an upper bound on real-world success. Real networks introduce additional barriers, including authentication, differing software configurations, security controls and unpredictable connectivity.

Third, the research did not combine every demonstrated capability into a single autonomous system running exclusively on inexpensive consumer hardware.

The TV-box experiment demonstrated distributed inference. The replication experiment demonstrated orchestration by a more capable model operating from a separate server.

The missing step is a small model that can both run on such hardware and reliably carry out the entire replication cycle.

Finally, performance remains a severe constraint.

Based on its experimental results, Anthropic estimated that setting up inference for a nine-billion-parameter model could require approximately 28 to 51 hours on the relevant low-power hardware. For the larger Gemma model, the unoptimized estimate rose to approximately 71 to 150 hours.

These are not the speeds associated with the most destructive conventional internet worms, some of which have spread extremely rapidly.

They describe a much slower process, potentially taking days to establish new instances.

Slow propagation could still become a cybersecurity problem if a system remains active for long periods. But it also gives defenders more time to identify unusual network behavior and intervene.

There is another reason for caution: Anthropic is both the organization publishing the research and a major commercial developer of advanced AI systems. Its findings deserve serious consideration, but its projections should be evaluated as research hypotheses, not treated as independently established timelines.

The Mirai botnet already showed how vulnerable smart devices can be

The weakest part of the scenario may have very little to do with artificial intelligence.

In 2016, the Mirai malware exploited poorly secured internet-connected devices, including cameras and routers, to assemble a massive botnet. Compromised devices were used to generate distributed denial-of-service attacks, overwhelming online services with traffic.

One major attack against DNS provider Dyn disrupted access to prominent websites and online platforms, including Twitter and Netflix.

Mirai did not require an advanced language model. It relied heavily on familiar security weaknesses, including default or weak device credentials.

That history makes Anthropic’s warning more concrete.

Millions of inexpensive connected devices have limited security support, outdated software or configurations that are rarely examined after installation. Some manufacturers provide little long-term maintenance, while owners may not even realize that their devices are accessible over a network.

An AI-powered worm would not need to invent those vulnerabilities. It could potentially exploit the same general category of weaknesses while becoming more flexible about the hardware it encounters.

There is also evidence that coordinated defenses can work.

Anthropic cites research into an internet service provider’s response to Mirai infections. When affected customers were quarantined and notified, 92% of infections were cleared within 14 days, compared with 74% in the comparison group without notification.

That figure is encouraging, but it should not be interpreted as proof that 92% of every botnet can be eliminated in two weeks. It describes a particular intervention and study population.

The larger lesson is that visibility, notification and coordinated remediation can substantially reduce infections.

How to protect connected devices from future AI worms

Anthropic’s findings reinforce security practices that already matter for conventional malware.

For consumers, the most immediate priority is to avoid leaving connected devices with weak or shared default credentials. Where supported, replace factory passwords with unique, strong alternatives and disable unnecessary remote administration features.

Keep firmware updated, particularly on devices exposed to the internet. A connected product that no longer receives security updates may deserve replacement, especially if it performs a sensitive function such as home surveillance or network management.

It can also help to separate less-trusted smart devices from computers and other systems containing sensitive information, using guest networks or dedicated IoT network segments where the router supports them.

For manufacturers, the challenge is more fundamental.

Devices should ship with secure defaults, supported update mechanisms and unnecessary services disabled. Security cannot depend entirely on customers discovering obscure configuration menus.

Network operators and security teams have another advantage: AI models are comparatively large software payloads, and distributed inference can create sustained communication between devices that would not ordinarily exchange substantial amounts of data.

Anthropic argues that those characteristics could make future AI worms detectable through unusual traffic patterns, even when the infected devices themselves are difficult to inspect.

There is a trade-off for a replicator. Spreading more quickly may generate more noticeable network activity. Operating quietly may make propagation slower.

That creates opportunities for monitoring, network isolation, honeypots and coordinated intervention.

The goal is not to invent an entirely new cybersecurity discipline for AI. It is to strengthen existing defenses before more adaptable automated threats become practical.

Could self-replicating AI become a real threat in 2027?

Anthropic’s most attention-grabbing prediction concerns timing.

The researchers argue that models with 30 billion parameters or fewer can already perform many individual tasks required for replication, although they still struggle to complete the full sequence reliably.

Using historical improvements in small-model capabilities, they estimate that models within this size range could reach the relevant capability threshold by the end of 2026. Self-contained, weight-based replicators might become feasible soon afterward.

That is a projection based on a general AI capability benchmark, not a direct measurement of when a real-world autonomous worm will appear.

Progress in coding and reasoning does not automatically translate into successful propagation across unpredictable consumer networks. Hardware limitations, access controls, security improvements and deployment complexity could delay or prevent particular scenarios.

There is also a meaningful difference between a system that can replicate under favorable conditions and one that can sustain a large-scale outbreak despite active defensive efforts.

Yet dismissing the research because its current demonstration is slow would miss its significance.

AI models are becoming smaller, more capable and easier to run outside centralized infrastructure. Meanwhile, connected devices are gaining processors and specialized AI accelerators that make local inference increasingly practical.

Those trends are moving in the same direction.

What Anthropic has identified is a possible convergence between increasingly capable autonomous software and an enormous population of poorly secured computers embedded in everyday objects.

The frightening version involves an AI worm that continuously discovers new hardware, adapts its deployment strategy and maintains a distributed presence without any central operator.

The more immediate version is less cinematic but arguably more relevant: attackers using increasingly capable AI agents to automate compromises, adapt malware and exploit neglected devices at scale.

Anthropic has not shown that AI can escape into the world’s smart appliances today. It has shown why the assumption that powerful AI must remain inside a controllable data center may become increasingly unreliable.

And if that assumption fails, the security of the next generation of AI systems may depend partly on something considerably less glamorous than model alignment: whether manufacturers bothered to secure a $55 TV box.

Self-replicating AI: Frequently asked questions

What is self-replicating AI?

Self-replicating AI refers to an AI system capable of establishing additional operational copies of itself, potentially across different computers, with limited or no human intervention. Anthropic’s research focuses on systems that deploy model weights and inference software onto other machines.

Did Anthropic create an AI virus?

No. Anthropic demonstrated distributed inference on physical TV boxes and a simplified replication workflow across simulated Android devices. It did not demonstrate a fully autonomous AI worm spreading through the public internet.

Can AI really run on smart TVs and household appliances?

Some AI models can run on constrained consumer hardware, particularly when their computation is distributed across multiple devices. Anthropic successfully operated a 26-billion-parameter model across 15 inexpensive Android TV boxes, although performance was extremely slow.

How quickly could an AI worm spread?

Anthropic estimates that early weight-based replicators running on weak IoT hardware could require days to establish new instances. Actual propagation speed would depend on model size, hardware capabilities, connectivity and security barriers.

Could an AI worm be shut down?

Yes, but a widely distributed system could be more difficult to eliminate than a centrally hosted AI service. Network monitoring, quarantining compromised devices, security updates and coordinated intervention by internet service providers could all help contain it.

When does Anthropic expect self-replicating AI to become possible?

Anthropic projects that sufficiently capable small models could emerge by the end of 2026, with autonomous weight-based replication potentially feasible soon afterward. This is an uncertain forecast, not a confirmed release date or an observed real-world threat.

Sources and further reading