Anthropic’s testing found that small AI models can perform several steps needed for self-replication across internet-connected devices, but it did not demonstrate a fully autonomous worm operating on real consumer hardware. The proposed threat would find unfamiliar devices, gain access, install software for inference and continue spreading without a central server to disable.
The model was split into shards so that each box carried part of the workload. The experiment showed that cheap devices could collectively run a capable model, not that they were independently spreading malware.
A separate evaluation tested whether models could configure inference on unfamiliar hardware and propagate through a controlled network. 5-9B successfully prepared software to run Llama3.
That means the test did not establish that a small model could independently discover devices, exploit them, install its payload, configure inference and repeat the cycle on its own. The setup was also slow: estimated inference preparation took 28 to 51 hours for Qwen3. 5-9B and 71 to 150 hours for Gemma4-26B-A4B on the tested hardware.
Anthropic estimates that models with 30 billion parameters or fewer could reach the demonstrated capability level by the end of 2026 if their historical improvement continues. A weight-based replicator could carry model files as part of its payload or download them, then run inference on compromised devices; because such a network would not have one central shutdown point, it could be difficult to stop even if its spread initially took days.
Suggested defensive measures include monitoring unusually large model transfers and device-to-device traffic, inspecting payloads with honeypots, quarantining infected devices and improving IoT security defaults. The evidence currently shows distributed inference and partial replication capabilities, alongside a projection about future performance, rather than an active self-spreading AI threat.