Anthropic has issued a warning that within a year compact artificial-intelligence models could autonomously replicate across a wide range of Internet-of-Things devices. The company says such capability would enable a new class of computer worms that spread without human interaction and are able to infect devices that have never been targeted before.
In a recent experiment Anthropic ran open-weight language models on inexpensive Android TV boxes and other low-cost IoT hardware. By applying quantization to reduce the bit-width of model weights and partitioning the workload into shards distributed across multiple devices, the researchers succeeded in loading the models and generating output, demonstrating that inference can be achieved on constrained platforms.
The lightweight Gemma4-26B-A4B model required fifteen boxes, each equipped with four gigabytes of memory, to reach inference. A different model, Qwen3.5-9B, was able to configure additional large language models on eight of nine tested hardware types. Anthropic notes that, unlike conventional malware that must be compiled for a specific architecture, the AI model leveraged its weight matrices to adapt configurations on the fly for each device.
The team then asked whether such compact models could generate self-replicating infections comparable to traditional IoT worms like Mirai, which install denial-of-service payloads. Anthropic argues that AI-driven worms could pose a substantially higher risk because they can craft exploits and payloads dynamically, tailoring each step to the target’s software stack rather than relying on a static code base.
Anthropic labels these autonomous agents ‘small weight-based replicators.’ The agents possess access to common exploitation utilities such as reverse shells and follow a four-stage flow: locate targets, obtain code execution, establish inference, and propagate to additional hosts. A notable advantage is the ability to learn on the job; failed attempts generate prompts, code snippets, and notes that future replicators can reuse, avoiding repeated mistakes.
The researchers identify the dynamic inference setup as the least explored and most difficult phase of the replication cycle. It demands a series of hardware- and software-specific decisions, including selecting compatible inference engines, installing required dependencies, and debugging platform-specific bugs. Anthropic emphasizes that these steps are serially dependent, making recovery from failures particularly challenging.
The experiment leaves several open questions. The Android devices used exposed an unauthenticated Android Debug Bridge, a development tool that should never be enabled in production because it grants full device access. Moreover, the replication process was orchestrated by a larger GLM-5.2 model rather than the small models themselves, which only ran a reduced Llama instance. Consequently, it remains unproven whether autonomous self-replication would occur without external coordination.