ai-security EN

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

• Source: securityweek.com • Feed: feeds.feedburner.com

Artificial Intelligence

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

By

Eduard Kovacs

|

October 13, 2026 (7:58 AM ET)

Botnet

Small AI models may be only months away from being able to self-replicate across commercial IoT devices, without needing a data center, according to research from Anthropic’s Frontier Red Team.

The study looks at AI worms that run their own model directly on the devices they compromise. Such malware would be hard to shut down because it has no central point to switch off, though it would likely spread slowly.

The researchers bought 15 off-brand Android-based TV boxes for about $55 each. A 26-billion-parameter open-weight model split across them ran at 0.39 tokens per second.

Rather than exploitation, which prior studies have already examined , the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested.

The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs.

Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials.

Advertisement. Scroll to continue reading.

Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026.

“Small weight-based replicators may be possible soon after,” the company says .

Anthropic also looked at a botnet as large as Kimwolf , which infected more than two million devices. If every 15 TV boxes ran one copy of the 26-billion-parameter model, such a botnet would host roughly 133,000 copies. Their combined compute would be worth at most about 40 Nvidia H100 GPUs, and each replication would take more than a day.

[ Read: AI Turns Familiar Cyberattacks Into a Race Against Time ]

Unlike traditional botnets built for specific devices, an AI worm could work out unfamiliar hardware on its own, Anthropic says. Defenders, however, still have some advantages.

Large model transfers and sustained traffic between devices that don’t normally communicate would stand out in ISP monitoring. In addition, moving manufacturers to more secure defaults, such as eliminating default passwords, would also shrink the target pool.

There is no full rogue replicator yet, Anthropic says, but models are getting better at each step in the chain and at passing what they learn on to their copies.

Related : OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks

Related : Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security

Related : Formula Predicts When AI Chatbots Are at Risk of Turning Bad

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

Written By

Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Eduard Kovacs

Latest News

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

iRhythm Data Breach Impacts at Least 360,000 People

Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach

Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward

Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day

Adobe Patches 176 Vulnerabilities Across 11 Products

Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

## Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

## Virtual Event: Zero Trust & Identity Strategies Summit 2026

October 14, 2026

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Register

People on the Move

Adam Zolle has joined Nike as CISO.

Jeff Hackett has been appointed CFO at internet intelligence provider Censys.

Accenture Federal Services has named Nathaniel Parker as CISO.

More People On The Move

Expert Insights

## AI Has Changed Attack Speed, Not Security Fundamentals

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

## Four Cyber Threats Harboring Big Plans for the Future

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

## Begin at the End: How to Enable Agentic Remediation

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

## “We Think the Security Control Is Working” Is No Longer Good Enough

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

## This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns illustration

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

SecurityWeek

Security Community

Stay Intouch

About SecurityWeek

News Tips

Got a confidential news tip? We want to hear from you.

Submit Tip

Advertising

Reach a large audience of enterprise cybersecurity professionals

Contact Us

Daily Briefing Newsletter

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.