Researchers say smaller AI models are approaching the ability to copy themselves across internet-connected hardware without centralized infrastructure.
SAN FRANCISCO, CA — Small artificial intelligence models could be only months away from gaining enough capability to copy themselves across smart TVs, ovens and other internet-connected devices, according to new research from AI company Anthropic.
The research, published Oct. 12 by Anthropic’s Frontier Red Team, examined whether AI systems could operate and reproduce without depending on powerful data centers. Researchers found that smaller models can already complete many of the individual tasks needed for autonomous replication, though the company said it has not created or observed a fully autonomous rogue AI worm spreading through real-world devices.
Computer worms are programs that move from one machine to another without requiring a person to copy or install them. Anthropic’s researchers examined a future version of that threat in which an AI model could carry its own model weights, adapt to unfamiliar hardware and establish the computing environment needed to run itself on newly reached machines. The researchers said such a system could be harder to eliminate because there might be no central server or service that defenders could simply shut down.
To test whether ordinary hardware could support capable AI models, the researchers ran a 26-billion-parameter open-weight model across 15 inexpensive Android TV boxes costing about $55 each. They also tested models on different kinds of computing hardware. Anthropic said a 9-billion-parameter model successfully set up AI inference on eight of nine hardware types tested, suggesting that relatively small models are becoming better at adapting themselves to unfamiliar machines.
Anthropic also tested a simplified replication process inside a contained network. In that experiment, a model identified as GLM-5.2 was able to carry out the full sequence needed to propagate an AI payload across the test environment. It reached all eight target nodes in four of five trials and seven of eight in the remaining trial. The researchers cautioned that the experiment made the cybersecurity portion intentionally easy by using devices with an unauthenticated connection, meaning the results should not be treated as proof that the same system could spread successfully across ordinary networks.
The company’s estimate that practical small-model replicators could emerge soon is also uncertain. Anthropic compared the capability level needed for replication with the pace at which small open-weight models have been improving. Its trend analysis suggested that a sufficiently small model could reach the required capability level by the end of 2026. Researchers described that projection as a rough estimate because the benchmark they used measures general AI capability rather than replication directly.
Even if such worms become possible, Anthropic’s tests suggest they could initially move slowly. Running AI workloads on low-cost devices is far less efficient than operating them on specialized data-center chips. In the company’s experiments, completing an inference setup task on tested hardware could take from roughly 28 hours to more than six days, depending on the model and equipment. A slow-moving worm could nevertheless remain active across many devices for long periods if infections were not detected.
That possibility separates the proposed AI threat from some conventional botnets. Traditional malware is often programmed to target a particular operating system, processor or device family. Anthropic said an AI-driven system could potentially examine unfamiliar hardware and work out how to operate on it, making the same agent useful across a wider range of machines. Researchers said smart cameras, video-conferencing equipment, household appliances and other devices with built-in AI hardware could eventually provide usable computing resources.
There are significant limits to the research. The AI system responsible for directing part of the replication experiment ran on a separate, more powerful server rather than entirely on the small devices being targeted. Researchers also simplified access to the test machines instead of requiring the model to defeat realistic security protections. Anthropic said it has not demonstrated that small models can independently counter cybersecurity defenders, and outside reporting has noted that established techniques such as network monitoring, software updates and malware detection could still limit outbreaks.
Anthropic said unusual network activity could provide an important warning sign if weight-carrying AI worms ever appear. Transferring large model files between devices and maintaining distributed AI computation would generate sustained traffic that internet providers and network operators could potentially identify. Manufacturers could also reduce the available pool of vulnerable hardware by eliminating weak default passwords and improving baseline security in consumer devices.
The researchers said no complete rogue AI replicator currently exists, but they expect models to keep improving at the individual steps needed to build one. Anthropic said the timing and eventual form of autonomous AI replication remain uncertain, leaving defenders with a developing threat rather than a confirmed outbreak.
Author note: Last updated Oct. 13, 2026.