Small AI Models May Soon Copy Themselves Across Smart Devices

Anthropic warned that small AI models could be months away from gaining self-replicating capabilities. The Verge

The warning shifts attention away from the data center. Frontier models, potentially with trillions of parameters, the values that set a model's size and behavior, need vast computing power that keeps them largely in data centers. Smaller models can run on consumer-grade hardware and are often free to download.

To test that edge case, Anthropic researchers split Google's Gemma 4, a model with 26 billion parameters, across 15 Android smart TV boxes. None could run it alone. Working as a cluster, the boxes ran the full model by splitting the work, a method called sharded, distributed inference.

A second test addressed spread. Anthropic built a simulated network of computers set up to behave like Android devices. It tested an AI-powered worm tasked with finding new machines, copying the AI model onto them, and getting it running on each one.

Only one model tested, GLM-5.2 from China's Z.ai, spread across the entire simulated network. Smaller models completed individual steps of self-replication even when they did not spread across the entire network. Anthropic researchers predict smaller models could match GLM-5.2 by the end of the year based on how quickly they are improving.

The test design separated the operator from the payload. The AI model copied in the worm experiment was Meta's Llama 3.1-8B, with 8 billion parameters. It was different from and much smaller than the model coordinating the attack. In effect, a capable agent handled reconnaissance, intrusion, and installation, while a compact, portable model served as the replicating artifact.

Anthropic published its research on Oct. 12, 2026. Anthropic The company stated that small AI models may be able to self-replicate across cheap IoT devices like Android TV boxes with no datacenter.

Coverage on Oct. 13, 2026 described the same concern in operational terms. Anthropic described AI models potentially infiltrating internet-connected devices such as smart ovens and Android TV boxes. CNBC Other reports framed the outcome as models that could clone themselves and infect internet-connected devices such as smart TVs and appliances, CBS wreak havoc on the web, Reuters and become challenging to shut down once distributed across smart home devices. Yahoo Anthropic also flagged a danger of botnets automating cyberattacks in connection with self-replicating AI.

Separately, Anthropic announced an expanded Cyber Verification Program on Oct. 6, 2026. The program makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals.

The broader context here is containment. For enterprise defenders, the working assumption has been that cutting off centralized compute limits misuse. Sharded inference across cheap endpoints breaks that assumption. Persistence does not require stealing a frontier model or holding access to a cluster. It requires enough compromised low-end nodes to host a useful small model and enough agent skill to keep finding the next node.

For practitioners, the split that matters most is between coordinator and payload. An 8B-class payload is already portable. The gating factor is agentic reliability across different targets, password handling, setup differences, and recovery from partial failure. Anthropic's result suggests that gating factor is narrowing. Partial success by smaller models is the relevant signal.

In my view, the defensive problem looks less like model control and more like IoT hygiene at scale. Patch cadence, default passwords, lateral movement between consumer devices, and lack of visibility into outbound traffic are familiar issues. What changes is automation of the full loop, from discovery to installation to inference, without human pacing. Botnet operations already automate break-ins. An agent that can adapt setup steps per device and check that a copied model actually runs closes a gap that previously took operator effort.

One point worth flagging for security teams is the verification approach Anthropic points to. Giving vetted researchers access to stronger cyber tools mirrors how powerful security tools have long been shared under controlled disclosure. Defenders need production-grade tools to build detection. Wider availability increases misuse risk. Anthropic has chosen a gated program for that access.

The optimistic read is still available. The same traits that make small models portable make defensive models portable. Local analysis, on-device anomaly detection, and automated triage do not need data-center scale if an 8B-class model can run across pooled consumer hardware. The constraint will be deployment and maintenance, not raw capability.