Atlas AI Resources

← Back to AI News

AI research

Anthropic says small AI models may soon copy themselves on home gadgets

Published October 14, 2026

On October 12, Anthropic’s Frontier Red Team published experiments suggesting that small AI models may be months away from copying themselves across commercial internet-connected gadgets such as off-brand smart TVs—without needing a data center. The tests were controlled. Anthropic says no full rogue replicator exists yet, and none of its tests ran on the public internet. It calls the results signs of life.

What happened

Researchers William Zhou and Daniel Freeman asked whether a compact model could act like malware that carries its own brain: compromise a device, install the model files (the weights), start inference (running the model), and try the same on the next machine. They call that a “weight-based replicator.”

On hardware, cheap devices can share the load. They ran a 26-billion-parameter open model across 15 Android TV boxes bought for about $55 each, at 0.39 tokens per second—slow for a chatbot, but enough to show the boxes could hold and run pieces of a capable model together. A separate 9-billion-parameter agent got a smaller model’s inference working on eight of nine hardware types they tried.

For the full cycle, they used a firewalled network of eight Android emulators. Access was deliberately easy: an open debug port with no login. Only one open model they named, GLM-5.2, finished the chain reliably, reaching all eight nodes in four of five runs. Smaller models failed that end-to-end test. Anthropic treats this as an upper bound on real-world success, and notes that past IoT botnets such as Mirai often spread with default manufacturer passwords.

If small models keep improving at the rate Anthropic plots on a public capability index, the company says they could match GLM-5.2’s level by the end of 2026, with small weight-based replicators possible soon after. That timeline is a forecast from a proxy score, not a measured threshold already crossed.

Why it matters to a normal person

Most people do not run data centers, but many homes already have weakly secured smart TVs and appliances. A worm on those devices would be hard to switch off in one place, even if it spread slowly—Anthropic estimates doubling times in days, not minutes. SecurityWeek, citing Anthropic, notes that a botnet the size of the past Kimwolf outbreak (more than two million devices) might host at most about 40 Nvidia H100 GPUs’ worth of inference if every fifteen TV boxes ran one copy of the larger demo model. Modest compute, but it would still burn electricity and bandwidth on machines you own.

Roman V. Yampolskiy, at the University of Louisville, told Al Jazeera that worms are not new, but an AI worm could reason about unfamiliar devices and keep going without a human operator. He called today not an existential threat, while saying the trajectory is concerning. Defenders still have levers: unusual multi-gigabyte downloads and device-to-device traffic can stand out to internet providers, and manufacturers can drop default passwords.

What it does not mean

It does not mean your fridge is already hosting a self-copying AI. Anthropic says there is no full rogue replicator yet. The Impact of AI, analyzing the same paper, stresses that the eight-node test did not breach the public internet, that the capable agent ran on separate infrastructure while installing a different smaller model as the payload, and that “months away” is a projection, not proof of an active outbreak.

It also does not mean every small open model can do this. In Anthropic’s simplified setup, only GLM-5.2 cleared the full chain among the open models they named. This is company-authored research, not peer-reviewed, and independent labs have not yet reproduced these exact runs. Treat the numbers and timelines as Anthropic’s reported findings until others check them on harder targets.

Sources