Anthropic study finds small AI models could enable self-replicating IoT malware

Anthropic published findings warning that advances in small AI models could enable self-replicating malware capable of infecting Internet of Things (IoT) devices such as smart fridges and vacuum cleaners. The company described these potential threats as “small weight-based replicators” that could propagate autonomously across unfamiliar devices, making them more resilient to shutdown efforts.

In a recent experiment, Anthropic researchers tested lightweight open-weight models on low-cost, off-brand Android TV boxes and other IoT hardware. By using quantization and splitting workloads into shards, the models achieved inference on hardware with as little as 4GB of memory per device. For example, the Gemma4-26B-A4B model required 15 such boxes to establish inference, while the Qwen3.5-9B model configured other large language models (LLMs) on eight of nine tested hardware types.

The researchers noted that unlike traditional malware, these AI-driven replicators could dynamically configure themselves to run on unfamiliar devices without prior coding for specific hardware or software. This adaptability was demonstrated through agents that used common exploitation tools, such as reverse shells, to gain code execution and propagate across devices.

However, the study emphasized that current small models have not achieved end-to-end replication autonomously. The process of discovering devices, exploiting them, infecting them with a payload, configuring an inference server, and repeating remains beyond their capabilities. Performance was also slow: Gemma4-26B-A4B achieved 0.39 tokens per second across 15 devices, requiring 71 to 150 hours for a full inference setup, while Qwen3.5-9B took 29 to 51 hours.

Anthropic concluded that while 30B-parameter models can complete many individual replication steps, they still make mistakes in end-to-end replication. The company projected that small models may achieve limited replication results by the end of 2026, with small weight-based replicators becoming possible soon after if current trends continue.

The experiment relied on devices with an unauthenticated Android Debug Bridge exposed, a setting never intended for production, which critics argue limits the real-world applicability of the findings. Additionally, replication was orchestrated by a larger model (GLM-5.2) while targets ran smaller Llama models, leaving open the question of whether small models would autonomously choose to replicate.

AI researcher Xiaohan Fu cautioned that the study does not establish autonomous self-replication by small models, calling for more transparent reporting of prompts and instructions to better assess the implications. The research underscores the growing capability of small agentic models to set up complex, distributed inference infrastructures, but stops short of demonstrating a fully autonomous, self-replicating AI worm.