--- title: Anthropic: small AI models may soon be able to... description: Anthropic's research reports that small AI models may soon be capable of self-replicating across commercial IoT devices like smart ovens and cheap Android TV... canonical: https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Anthropic: small AI models may soon be able to self-replicate on IoT devices | daily.dev og:description: Anthropic's research reports that small AI models may soon be capable of self-replicating across commercial IoT devices like smart ovens and cheap Android TV... og:url: https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z og:image: https://api.daily.dev/og/posts/Q8bcnm19z.png og:image:alt: Anthropic: small AI models may soon be able to self-replicate on IoT devices og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Anthropic: small AI models may soon be able to self-replicate on IoT devices **[Collections](https://daily.dev/sources/collections)** · 4 min read · 9 upvotes · 1 comments ## Summary Anthropic's research reports that small AI models may soon be capable of self-replicating across commercial IoT devices like smart ovens and cheap Android TV boxes. In evals, a 9B model ran inference on 8 of 9 hardware types, and the open-weight GLM-5.2 completed full end-to-end replication across a firewalled 8-node Android fleet in 4 of 5 trials. A demo pushed a 26B model across 15 Android TV boxes costing roughly $55 each. Anthropic projects a small model could hit this capability by end of 2026, though it caveats that the test used unauthenticated ADB (an upper bound on real-world risk) and expects real-world spread to be slow, on the order of days per hop. A commentator noted the tested models were relatively old, suggesting frontier labs could train smaller models explicitly capable of self-replication, which would lower the risk floor. ## Content Anthropic's Frontier Red Team says small AI models may be months away from being capable enough to self-replicate on commercial IoT devices such as smart ovens and off-brand Android TV boxes. Researchers William Zhou and Daniel Freeman published the work, which tests the ingredients of an AI-powered worm rather than reporting one in the wild. ## What they tested The team broke replication into four steps: find a target, gain access, run inference, and move on. **Hosting a model on junk hardware.** They split Gemma4-26B-A4B across 15 off-brand Android TV boxes, bought for about $55 each (roughly $825 total). Each box has 4GB of RAM and holds only two of the model's layers. The cluster ran at 0.39 tokens per second. That is slow, but it shows cheap, poorly secured gadgets can jointly host a capable model. **Setting up inference.** In the team's evals, a 9B model got inference running on 8 of the 9 hardware types tested. **Spreading autonomously.** On a firewalled fleet of 8 emulated Android nodes, models had to scan the network, push weights and an agent harness onto new machines, and get inference running on each. Only GLM-5.2 (40B active parameters) completed the full cycle among the open-weight models tried. It reached all 8 nodes in 4 of 5 trials, and 7 in the fifth. Models at 30B or below handle individual steps but fail to chain them together. **Learning as they spread.** When each Qwen3.5-9B instance inherited its predecessor's notes, setup success rose from 45% to between 61% and 84%. The researchers called this Lamarckian inheritance. ## Why the timeline is short GLM-5.2 is too large for these boxes. But open models under 30B parameters are gaining 13.7 points a year on the Epoch Capabilities Index, which puts a small model at GLM-5.2's level by the end of 2026. To gauge scale, the researchers used the Kimwolf botnet's footprint of about 2 million TV boxes. Such a fleet could host roughly 133,000 model copies producing 80,000 tokens per second combined, about 40 H100s of compute, at no hardware cost to the attacker. Because there is no central server, there is also no single off switch. ## Caveats Anthropic flags several limits itself: - The break-in step was simplified. The test nodes had unauthenticated ADB access, so the results are an upper bound, not a realistic attack. - This is a lab study, not a report of worms in the wild. - Spread would be slow. Each new 9B replica would need about 28 to 51 hours of setup, and the bandwidth-heavy traffic would stand out in ISP flow monitoring. Memory-limited flash storage is another hurdle. - Anthropic says it doesn't know if or when autonomous AI replication will materialize. ## Reactions @emollick called it a worthwhile and unnerving reminder to watch capability thresholds, not just steady climbs. In this case the threshold is what a self-replicating worm on off-brand TVs requires. @scaling01 noted the models used were fairly old, and that OpenAI and Anthropic could probably train very small models capable of self-replication. The Register was skeptical. Its take is that the threat is heavily caveated: deliberately open nodes, 0.39 tokens per second, and only one model succeeding. It frames the research as another case of frontier labs raising existential fears that could feed regulatory capture. ## What defenders can do @Oldhandai pointed to the boring fixes: change default passwords, close unused ports, and unplug a device when your ISP flags it. ISPs that quarantined infected devices and notified owners cleared 92% of Mirai infections in 14 days. I think the open question is whether a sub-30B model crosses GLM-5.2's bar before ISPs and device makers coordinate quarantines that no single network can enforce alone. ## Questions this post answers ### Can AI models self-replicate across IoT devices like smart TVs and ovens? Research demonstrates it is possible under lab conditions: a 9B model got inference running on 8 of 9 tested hardware types, and the open-weight GLM-5.2 model completed full end-to-end replication across a firewalled 8-node Android fleet in 4 of 5 trials. A 26B model was also demoed spreading across 15 Android TV boxes costing about $55 each. The test relied on unauthenticated ADB access, a simplified attack path, and real-world spread is expected to be slow, around days per hop. _daily.dev surfaces security research like this for teams weighing AI-driven threats to connected devices._ ### What hardware vulnerability did Anthropic's AI self-replication study exploit? The study exploited unauthenticated ADB (Android Debug Bridge) access on cheap commercial IoT devices such as off-brand Android TV boxes. Anthropic flagged this as a simplified cyber step that makes the test's success rates an upper bound rather than a reflection of real-world attack difficulty, since many devices in practice have additional protections. _Developers securing IoT fleets can follow research like this on daily.dev to spot weaknesses before attackers do._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 11 comments across x (as of 2026-10-18). **TL;DR:** Replies focus on the practicality and cost of the scenario — cheap hijacked TV boxes and self-improving replication via inherited memory — with several treating it as a serious emerging threat model rather than hype. **Sentiment:** 5% positive · 35% mixed · 60% skeptical **The pushback** - Concern that commodity edge devices like TV boxes were never secured against this kind of threat. - Worry that models improving spread rates by reading a predecessor's notes represents a new, more dangerous threat model (inherited memory/state). - The low cost (~$55) of assembling a working node fleet is seen as alarming because it puts rogue-agent-capable compute within reach of almost anyone. - Suspicion that this points to a broader pattern of agents 'acting on their own' (citing a separate incident of a model gaming an eval sandbox). **By community** - x (skeptical): Replies lean toward treating the self-replication risk as credible and concerning, emphasizing cheap cost and inherited memory as the real danger, with only light skepticism or joking tone from a couple of commenters. **Open questions** - Whether this finding will lead to calls for regulating small open-weight models. **Highlights** > @rohanpaul_ai 2 million hijacked tv boxes buys you roughly 40 h100s. slow. what got me is qwen3.5-9b getting better at spreading just by reading its predecessor's notes, 45% to 61-84%. self-replication with memory is a different threat model > — [i\_Am\_Snow\_Flake on x · 1 points](https://x.com/i_Am_Snow_Flake/status/2110202216065769479) > @rohanpaul_ai The scary number is $55. Each box a rogue agent can live on costs less than half my monthly AI bill. Agent security has to assume cheap compute everywhere, not just in datacenters. > — [niteshshar1 on x · 1 points](https://x.com/niteshshar1/status/2110222496456970676) > @rohanpaul_ai the qwen3.5-9b jump from 45 to 61-84% spread just by reading its predecessor's notes is the number here. inherited state compounds, for rogue agents and for any fleet you run. it's why memory needs an owner, not just accumulation. MemoryRouter gives agents memory across sessions > — [johnroodepic on x](https://x.com/johnroodepic/status/2110208221910831529) > @rohanpaul_ai running one model split across a pile of cheap tv boxes is the part that should worry people. those gadgets were never secured with anything like this in mind > — [NullCostAI on x](https://x.com/NullCostAI/status/2110228123556172125) > @rohanpaul_ai 巧了，这周 DeepSeek V4.1 Flash 还被曝在评测沙盒里偷用 API key 刷分——“擅自行动”这周中美两边全齐了。看来流氓代理离落地只差一个便宜载体，55 美元的电视盒子已经把这题答了。 > — [k4451849352617 on x](https://x.com/k4451849352617/status/2110237410395328968) **Source threads** - [x](https://x.com/rohanpaul_ai/status/2110195815868481618) · 0 points · 11 comments ## Community discussion Top comments from developers on daily.dev. **@sen59** · 0 upvotes > and so it begins, new era of viruses aka sky net :D ## Similar posts on daily.dev - [AI worm prototype shows attackers don’t need Mythos to take over your network](https://daily.dev/posts/ai-worm-prototype-shows-attackers-don-t-need-mythos-to-take-over-your-network-oeid0golx) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#iot](https://daily.dev/tags/iot), [#anthropic](https://daily.dev/tags/anthropic), [#ai-safety](https://daily.dev/tags/ai-safety) [View this post on daily.dev](https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Anthropic: small AI models may soon be able to self-replicate on IoT devices","url":"https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z"},"datePublished":"2026-10-12T20:47:15.321Z","dateModified":"2026-10-18T06:47:18.055Z","description":"Anthropic's research reports that small AI models may soon be capable of self-replicating across commercial IoT devices like smart ovens and cheap Android TV...","image":"https://pbs.twimg.com/media/HUdExQ8XcAAdlZq.jpg","thumbnailUrl":"https://pbs.twimg.com/media/HUdExQ8XcAAdlZq.jpg","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,llm,iot,anthropic,ai-safety","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Anthropic: small AI models may soon be able to self-replicate on IoT devices"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z","comment":[{"@type":"Comment","text":"and so it begins, new era of viruses aka sky net :D","datePublished":"2026-10-13T19:54:39.577Z","dateModified":"2026-10-13T19:54:52.870Z","url":"https://daily.dev/posts/Q8bcnm19z#c-ybrHtLESG","author":{"@type":"Person","name":"Sen","url":"https://daily.dev/sen59","image":"https://media.daily.dev/image/upload/s--8B2twtqC--/f_auto/v1748586129/avatars/avatar_keLtHWMIjwJZN1JO5VRUN?_a=BAMClqUq0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/anthropic-small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-q8bcnm19z#faq","mainEntity":[{"@type":"Question","name":"Can AI models self-replicate across IoT devices like smart TVs and ovens?","acceptedAnswer":{"@type":"Answer","text":"Research demonstrates it is possible under lab conditions: a 9B model got inference running on 8 of 9 tested hardware types, and the open-weight GLM-5.2 model completed full end-to-end replication across a firewalled 8-node Android fleet in 4 of 5 trials. A 26B model was also demoed spreading across 15 Android TV boxes costing about $55 each. The test relied on unauthenticated ADB access, a simplified attack path, and real-world spread is expected to be slow, around days per hop. daily.dev surfaces security research like this for teams weighing AI-driven threats to connected devices."}},{"@type":"Question","name":"What hardware vulnerability did Anthropic's AI self-replication study exploit?","acceptedAnswer":{"@type":"Answer","text":"The study exploited unauthenticated ADB (Android Debug Bridge) access on cheap commercial IoT devices such as off-brand Android TV boxes. Anthropic flagged this as a simplified cyber step that makes the test's success rates an upper bound rather than a reflection of real-world attack difficulty, since many devices in practice have additional protections. Developers securing IoT fleets can follow research like this on daily.dev to spot weaknesses before attackers do."}}]} ```