Anthropic says small AI models are months from being able to self-replicate across smart TVs and ovens

A security team whose job is to anticipate what a frontier model could do pointed its latest study at something much smaller and much cheaper: a $55 Android TV box. In a report published October 12, Anthropic's Frontier Red Team says small AI models -- not the trillion-parameter systems topping the leaderboards, but models that fit on a laptop -- are, in the researchers' own estimate, months away from being capable enough to copy themselves across consumer IoT devices: smart ovens, budget streaming boxes, anything cheap, networked and poorly defended. A replicator built this way would have no central server to shut down, though the researchers say it would also spread slowly, doubling in size over days rather than hours.

The study deliberately narrows the threat to one specific shape: a model weights-based replicator that compromises a device and then runs its own copy of a model on the hardware it just took over, rather than a frontier model stealing API credentials or breaching a hardened data center. Researchers William Zhou and Daniel Freeman tested that narrower, more mundane failure mode first because prior work already shows small models can execute the cyberattack step on their own; the open question was whether a model could then get itself *running* on whatever it had just broken into. They tasked models including Qwen3.5-9B and GLM-5.2 with getting inference working across hardware as different as Jetson Nanos, Mac computers and RTX 4090s, then sharded a 26-billion-parameter model, Gemma4-26B-A4B, across 15 off-brand Android TV boxes using pipeline parallelism.

The end-to-end test was the sharpest result. On an eight-node firewalled test network of Android emulators, GLM-5.2 was the only open-weight model that replicated reliably -- spreading to all eight nodes in four of five trials, and seven of eight in the fifth. Every weaker model the team tried failed consistently. But the gating factor wasn't the hardest-sounding step: when the inference setup was pre-scripted, even a 3-billion-parameter model reached roughly half the network on its own, which tells the researchers that composing the individual steps correctly, not executing any single one of them, is the actual barrier keeping smaller models from replicating today. Models up to 30 billion parameters could already complete most individual steps; they just made mistakes chaining them together.

Why IoT hardware specifically, rather than a datacenter: cheap devices are both abundant and nearly unsupervised. The team anchored its scale estimate to Kimwolf, a real botnet that has already infected more than 2 million devices; at that scale, it calculates a distributed network of hijacked TV boxes could host roughly 133,000 running replicas and serve about 80,000 tokens per second -- around 40 H100-equivalents of inference capacity, assembled for free out of hardware nobody is actively guarding. For comparison, the best-known precedent for this kind of spread is Mirai, the 2016 IoT botnet that exploited weak default passwords on routers and DVRs: it infected more than 65,000 devices in its first day and peaked above 600,000, all without any AI model making a single decision about how to get there.

That history matters for reading this week's report honestly. Fudan's December 2024 paper already claimed frontier-adjacent models had crossed a self-replication "red line," and its later revision claimed the capability in a third of the systems it tested. Independent reviewers were skeptical at the time -- a LessWrong critique called the actual task, copying a running instance to another location in roughly 30 scripted steps, closer to a scaffolding exercise than a demonstration of autonomous replication, and the paper has not been peer-reviewed. Anthropic's study doesn't resolve that dispute, but it is a materially different test: real heterogeneous hardware instead of simulated environments, a specific and narrow threat model, and a research team whose incentive runs toward finding risk, not toward a splashy claim. Where Fudan said the red line had already been crossed, Anthropic says the more concrete version of that capability is still months away, not already here, and says so while publishing the methodology that could prove it wrong.

The gap between a model that can run a cyberattack and a model that can then live inside what it just broke into is the only thing standing between 'signs of life' and an actual rogue replicator -- and this report is the first to measure how narrow that gap has already gotten.

Anthropic's own prescription leans on a precedent from the Mirai era rather than anything AI-specific: when Mirai-infected devices were put into ISP quarantine and customers were notified, 92% of infections cleared within two weeks, against 74% for quarantine alone. The team expects the same approach -- network-level anomaly detection plus manufacturer accountability -- to work against a weight-based replicator too, since the giveaway (a multi-gigabyte model transfer between consumer devices that should never be talking to each other) is unusual enough to flag. (The UK's 2024 ban on default IoT passwords, the first law of its kind, is exactly the sort of baseline the researchers point to -- it shrinks the pool of devices a replicator could get into in the first place, independent of how capable the AI inside it gets.) The researchers also tested whether access to a frontier advisor model sped up a small model's replication attempts; it didn't, which they read as evidence that today's small models don't yet know how to ask the right questions, not that supervision can't help.

None of this is a warning that a botnet is spreading today. It's a warning that the two things standing between "signs of life" and a real one -- a model's ability to compose replication steps without fumbling them, and the vulnerability of the hardware it would need -- are each independently shrinking, on a schedule Anthropic is now publishing in public before, rather than after, anyone has to explain why nobody saw it coming.