Anthropic Warns AI Models Could Soon Self-Replicate Across Smart TVs and IoT Devices

Anthropic researchers have raised concerns that small artificial intelligence models could soon replicate autonomously across consumer Internet of Things (IoT) devices.

This development may lead to decentralized networks that operate independently of data center infrastructure.

In research dated October 12, 2026, William Zhou and Daniel Freeman described experiments showing that affordable Android TV boxes, smart appliances, and other connected devices could host locally running AI models that could propagate further.

Their findings focus on weight-based replicators: AI worms that carry their model weights onto compromised systems or download them from public repositories, then use the victims’ computing resources for inference.

Anthropic Warns AI Models

The researchers demonstrated the Gemma4-26B-A4B model running across 15 inexpensive Android TV boxes, each costing around $55. This distributed configuration produced 0.39 tokens per second, with each box managing two model layers.

While the performance is relatively slow, the demonstration shows that running substantial models does not necessarily require specialized data center GPUs. Model components, or “shards,” can function across multiple networked devices, collectively generating outputs.

The researchers identified potential hosts for significant portions of models under 30 billion parameters, including smart refrigerators, ovens, robotic vacuum cleaners, and lawnmowers. Devices equipped with onboard AI processors could offer additional computing power.

The study outlined four stages of autonomous replication: discovering targets, obtaining execution, establishing inference, and continuing propagation from newly compromised hosts.

It primarily focused on inference setup rather than exploitation. Previous research has shown AI agents propagating across diverse networks by adapting attacks and executing open-weight models on compromised devices.

To assess deployment capabilities, the researchers tasked open-weight models with serving Llama3.1-8B across nine different hardware types.

The Qwen3.5-9B model successfully established inference on eight of these hardware categories. The tested platforms included Jetson Nanos, Mac computers, and systems equipped with RTX 4090 GPUs. More capable models, such as GLM-5.2, demonstrated enhanced reliability and faster performance.

The researchers noted that these hardware examples illustrated deployment capabilities but did not highlight vulnerabilities in specific chips.

The experiments used Memento, a harness built on the open-source Pi coding agent, to keep agents from fixating on incorrect debugging explanations.

Memento periodically restarted an agent while preserving its workspace and notes about previous attempts. This practice allowed subsequent instances to pursue alternative strategies rather than repeatedly following unproductive ones.

One notable failure involved a Qwen agent that spent hours investigating package versions when the actual issue was an endpoint incompatible with the evaluation API.

Models with 30 billion parameters or fewer can already execute many individual replication steps. However, they still tend to make errors when trying to combine them.

In simplified evaluations, GLM-5.2 and stronger models completed end-to-end replication. The researchers expect smaller models to achieve similar capabilities by the end of the year if historical improvement rates continue.

However, this projection does not imply the risk of an uncontrolled outbreak among consumer devices. Locally running, adaptive worms may lack a centralized shutdown mechanism, making containment challenging, even if their populations double in just a few days. It is important to distinguish between successful deployment and demonstrated exploitation or sustained, uncontrolled propagation.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.