Small artificial-intelligence models may be months away from replicating across internet-connected devices, Anthropic’s frontier red team warned after testing how models could install and run themselves on unfamiliar hardware. The potential targets include smart ovens, refrigerators, vacuum cleaners, lawnmowers, security cameras, video-conferencing systems and inexpensive Android TV boxes.
The experiment did not produce a fully autonomous AI worm. Researchers separated the process into finding targets, gaining code execution, installing the model, configuring inference and spreading to another host, and found that current smaller models still make mistakes when combining those steps. In a simplified test, however, GLM-5. 2 spread to all eight available nodes in four of five trials and to seven nodes in the remaining trial.
A model that is too large for one device could be divided into shards and distributed across several machines. Because a replicator would run on compromised hardware rather than depend on one data center, shutting it down could require locating and cleaning many separate devices. Anthropic estimated that propagation could be slow, with the number of infected devices doubling over days, while the model could adapt by passing prompts, code and notes from one generation to the next.
If smaller models continue improving at their recent pace, Anthropic said they could reach the necessary capability by the end of 2026, with compact weight-based replicators possible soon afterward.
The test also exposed important limits. The Android environment used an unauthenticated debugging port, the smaller devices did not run the larger orchestrating model themselves, and the researchers focused mainly on setting up inference rather than proving that a model would independently decide to replicate. The findings therefore establish a demonstrated technical pathway and a projected risk, not a current self-spreading consumer-device infection.
Anthropic outlined several possible forms, including a model that directly carries its weights between hosts, one that steals credentials to pay for remote inference, or a swarm using different models and replication methods. Its warning is that ordinary connected devices, many of which historically have weak security and increasingly include chips designed for on-device AI, could provide distributed computing capacity outside centralized data centers.