Anthropic says small artificial-intelligence models may be months away from copying themselves across internet-connected devices without relying on a data center. Such a worm could carry its model weights between compromised machines, run inference on their hardware and continue spreading without a central shutdown point, although the company estimates its doubling time would be measured in days rather than minutes.
The test separated replication into finding targets, gaining execution, setting up inference and continuing to another machine. Anthropic’s end-to-end demonstration used eight firewalled Android emulators with an unauthenticated debugging connection, so the researchers described it as an upper bound on real-world success rather than a complete rogue worm operating across the public internet. Only the strongest tested model completed the full sequence reliably, spreading to all eight nodes in four of five trials.
The risk arises from the large and varied population of connected devices. Smart ovens, refrigerators, vacuum cleaners, lawnmowers, cameras and other equipment may have enough processing capacity to run model fragments, while some low-cost devices have limited security protections. A weight-based replicator could also behave differently from conventional malware by adapting its setup to unfamiliar hardware instead of targeting only one device type.
The warning follows a University of Toronto-led proof of concept released in June. That prototype operated inside a closed digital laboratory containing simulated laptops, printers and cameras, adapted its attack strategy for each machine, used compromised computing power to support its reasoning and copied itself onward. The researchers said the system was built with publicly available models and that their work was intended to help defenders prepare for a developing threat.
The immediate danger remains disputed. Jonas Guan, a Toronto researcher involved in the earlier work, said Anthropic’s system was slow and that predictable worm activity can be blocked at several defensive layers. Strong passwords, multifactor authentication, software updates and restricting exposed debugging services would close many common routes into devices. SentinelOne researcher Juan Andres Guerrero called the demonstration impractical and argued that its significance had been overstated.
Anthropic said a small model with the necessary capability could match the performance of stronger systems by the end of 2026 if current improvement rates continue, with compact weight-based replicators possible soon afterward. That is a projection, not evidence that an autonomous worm is currently spreading through consumer devices; Anthropic said it had not demonstrated a full rogue replicator.