Anthropic showed that small AI models can run across cheap smart devices and that more capable models can complete a simplified self-replication chain. Your toaster isn’t plotting against you. But maybe we should finally secure the toaster.
There is a particular kind of cybersecurity headline guaranteed to make people click.
SELF-REPLICATING AI COULD INFECT YOUR SMART OVEN.
Excellent.
Apparently we’ve reached the part of the future where I need to worry about my refrigerator joining a botnet while simultaneously refusing to make enough ice.
Before anyone starts unplugging the Roomba and burying Alexa in the backyard, there is some important context.
Anthropic published research showing that small AI models are getting surprisingly close to being capable of autonomously replicating across relatively weak Internet-of-Things devices.
The researchers demonstrated pieces of that process.
They even demonstrated the full replication chain in a simplified, controlled environment using a sufficiently capable model.
But they did not release an autonomous AI worm into someone’s collection of smart appliances.
They did not demonstrate a small model independently infecting and reproducing across real consumer IoT hardware end-to-end.
And they explicitly acknowledge that important capability and performance gaps remain. Anthropic
So:
No, your Samsung refrigerator has not become self-aware.
But the research exposes a much more practical problem.
AI may soon make the crappy IoT security we’ve tolerated for years substantially more useful to attackers.
And unlike robot-apocalypse scenarios, we already know how to do something about that.
First, What Did Anthropic Actually Do?
Anthropic’s Frontier Red Team was investigating something researchers call autonomous replication and adaptation, or ARA.
The idea is fairly straightforward.
Could an AI model:
find another computer,
gain access,
move the software and model it needs onto that computer,
get itself running,
and then repeat the process?
If you’re thinking:
Isn’t that basically a computer worm?
Correct.
Congratulations, you’ve survived the terminology portion of the article.
Traditional worms already propagate from machine to machine without a human individually telling them what to do.
What makes an AI-powered version interesting is that it may not need to have every step hard-coded in advance.
A capable model could potentially encounter an unfamiliar device and figure out:
What operating system is this?
What hardware does it have?
Which inference software will work?
Which packages do I need?
Why did installation fail?
What should I try instead?
Then continue.
That’s the difference.
The worm potentially becomes adaptable. Anthropic
Yes, They Really Ran AI Across Cheap TV Boxes
One of Anthropic’s more amusing experiments involved 15 inexpensive off-brand Android TV boxes, costing roughly $55 each.
Individually, these things aren’t exactly NVIDIA datacenters.
They typically had around 4 GB of RAM.
So Anthropic split Google’s Gemma4-26B-A4B model across all 15 devices, with each device holding only part of the model.
It worked.
Not quickly.
The distributed system generated around 0.39 tokens per second in Anthropic’s demonstration.
At that speed, asking it to write War and Peace may qualify as an intergenerational project.
But that’s not the point.
The point is that a reasonably capable model could run using computing power spread across cheap consumer hardware that was never intended to become a tiny distributed AI cluster. Anthropic
That’s genuinely interesting.
Then They Asked Models to Figure Out Unfamiliar Hardware
This part matters more.
Anthropic tested whether relatively small models could take unfamiliar machines and independently figure out how to set up an inference server on them.
One model, Qwen3.5-9B, successfully got inference running on 8 of the 9 hardware types tested.
The hardware ranged from low-power edge machines to Macs and systems with desktop GPUs. Anthropic
That’s exactly the adaptability that distinguishes this idea from a traditional scripted IoT worm.
A normal worm might contain:
If device = X, run exploit A.
If device = Y, run exploit B.
The AI version potentially says:
Huh. Never seen this thing before.
Let’s poke around.
Which, coincidentally, is also how most of us learned Linux.
Did It Actually Replicate?
Here’s where the headlines need some restraint.
Anthropic created a firewalled network of eight emulated Android devices and seeded one machine with the experimental worm.
The devices intentionally exposed an unauthenticated Android Debug Bridge, or ADB, port.
That matters.
There was no sophisticated zero-day required to get onto the next machine.
Anthropic deliberately simplified the compromise portion because the experiment was primarily testing whether models could orchestrate the complete replication workflow and get inference running after reaching another device. Anthropic
In that setup, GLM-5.2 successfully spread across all eight nodes in four out of five trials and reached seven in the fifth.
That’s impressive.
But there’s another major caveat.
GLM-5.2 itself is too large for the class of IoT hardware under discussion.
Anthropic used it to demonstrate the capability level required to orchestrate replication while deploying the much smaller Llama3.1-8B inference workload.
In other words:
We have models small enough to fit on cheap devices.
And we have larger models smart enough to reliably handle the replication process.
We don’t yet have one model that satisfies both requirements.
Anthropic describes this as a capabilities floor and a model-size ceiling.
Right now?
They don’t intersect. Anthropic
That’s probably the most important fact in the entire story.
So Where Did “Months Away” Come From?
Anthropic looked at how capabilities of open-weight models under 30 billion parameters have been improving.
Based on that trend, researchers estimated that a small model could reach the capability level demonstrated by GLM-5.2 by roughly the end of 2026.
But Anthropic is careful about this.
The measure they used is a general capability index, not a direct measurement of self-replication capability.
Anthropic calls the estimate rough. Anthropic
So:
“AI worms definitely arrive by Christmas”
is not what the research says.
It’s closer to:
If small-model capabilities keep improving at roughly their recent rate, the capability gap that currently prevents this may close surprisingly soon.
Still worth paying attention to.
Just maybe hold off on installing antivirus on the Crock-Pot.
And Whatever This Thing Is, It Would Be Slow
Current consumer-grade edge hardware is not particularly fast at this.
Anthropic estimated that setting up inference using Qwen3.5-9B in its experiments could take roughly 28 to 51 hours.
Gemma4-26B-A4B could take roughly 71 to 150 hours.
Anthropic’s modeled 9B replicator would therefore spread on a timescale of roughly one to two days per replication, not seconds. Anthropic
That’s a huge advantage for defenders.
Fast worms are terrifying because by the time you’ve figured out what’s happening, they’ve already introduced themselves to half the planet.
A slow replicator leaves footprints.
Big ones.
And that’s where this story becomes much more useful than scary.
We Already Have the IoT Botnet Problem
AI didn’t invent insecure smart devices.
We’ve been remarkably capable of screwing that up without help.
Remember Mirai?
In 2016, Mirai spread across cameras, DVRs, routers and other embedded systems, often by doing something technologically sophisticated enough to make security professionals reconsider their career choices:
Trying default usernames and passwords.
The original Mirai research tracked the botnet to a peak of roughly 600,000 infected devices.
Researchers concluded that its rapid growth was enabled in part by widespread default credentials and weak security across IoT hardware. USENIX
That was a decade ago.
Surely we fixed everything.
Right?
Right?
Spoiler: We Did Not Fix Everything
Modern IoT botnets remain enormous.
Cloudflare estimates that the Aisuru-Kimwolf botnet ecosystem contains roughly 1 million to 4 million infected devices, with Kimwolf alone involving approximately 2 million systems, primarily Android-based TV and streaming devices.
These aren’t theoretical lab machines.
They’ve been used to generate massive DDoS attacks.
Cloudflare recorded attacks associated with that ecosystem reaching into the tens of terabits per second. Cloudflare
So when Anthropic picked cheap Android TV boxes as a representative test platform, that wasn’t because researchers have a particular grudge against watching Netflix.
There’s already an enormous population of cheap, poorly secured, internet-connected hardware available to attackers.
AI doesn’t need to create that ecosystem.
We already built it for them.
Very thoughtful of us.
So What Changes When You Add AI?
A traditional IoT worm can be devastating.
But it tends to be fairly specialized.
Find vulnerable device.
Use known method.
Install payload.
Move on.
An AI-enabled version could potentially become more flexible.
Anthropic showed that small models can already troubleshoot unfamiliar hardware and software configurations.
Their experiments also allowed one generation of an agent to leave notes about what worked and what failed for the next generation.
The first-generation Qwen3.5-9B agents successfully completed the inference setup task about 45% of the time.
Later generations inheriting those notes reached roughly 61% to 84% success rates. Anthropic
That’s fascinating.
The malware doesn’t need to retrain its neural network.
It can simply leave itself a notebook.
Tried package version 4.7.
Broke everything.
Don’t do that again.
Essentially the same way human system administrators operate.
Except now the notes propagate with the malware.
That Doesn’t Mean the AI Is “Alive”
We should probably get this out of the way.
Self-replication does not equal consciousness.
Viruses replicate.
Computer worms replicate.
My inbox replicates.
None of those appear particularly sentient, although I’m reserving judgment on Outlook.
A future AI worm wouldn’t necessarily have some existential desire to survive.
It could simply be software given an objective and enough capability to pursue it autonomously.
That’s important because framing this as:
AI WANTS TO ESCAPE
takes us into science fiction when the actual cybersecurity problem is much more ordinary.
Someone could deliberately build malicious autonomous software.
Or legitimate agentic software could be modified or compromised.
The threat isn’t that your smart oven wakes up angry.
The threat is that adaptable malware becomes practical on hardware we’ve spent a decade barely securing.
That’s plenty.
The Good News: This Thing Would Be Noisy
This is the part of Anthropic’s research I wish received more attention.
A weight-based AI replicator has baggage.
Literal gigabytes of baggage.
Models aren’t tiny.
Moving them around creates network traffic.
Running distributed inference creates network traffic.
Scanning for additional targets creates network traffic.
Communicating between devices that previously had absolutely no reason to talk creates network traffic.
Anthropic specifically calls out several detectable signatures:
Large model transfers.
Sustained device-to-device communication.
Network scanning.
Unusual outbound connections. Anthropic
That’s useful.
If my smart television suddenly downloads several gigabytes and then starts maintaining sustained conversations with the lawnmower…
I have follow-up questions.
Detection Starts With Knowing What “Normal” Looks Like
This sounds painfully basic.
Because it is.
You cannot identify abnormal device behavior if you have no idea what devices are on your network.
For a company, that means asset inventory.
For a home, it can be as simple as opening the router or Wi-Fi controller and knowing:
TV.
Doorbell.
Thermostat.
Camera.
Speaker.
Vacuum.
Random mystery device labeled Tuya_8C:19:A2.
We’re coming back to you later.
Once you know what’s there, you can begin asking what those devices normally communicate with.
Your camera probably needs to reach its cloud service.
Your thermostat may need internet access.
Your television certainly thinks it needs access to approximately 700 advertising domains.
What probably isn’t normal?
The doorbell sending several gigabytes to the vacuum cleaner.
Watch East-West Traffic
This may become particularly useful.
Security people often focus heavily on north-south traffic:
Network to internet.
Internet to network.
But a self-replicating IoT worm needs to move east-west:
Device to device.
Anthropic’s hypothetical replicator requires infected machines to discover and communicate with other machines, and distributed inference itself could require sustained communication among groups of devices. Anthropic
For businesses, that means network detection and response tools, firewall logs, flow telemetry and segmentation become extremely valuable.
For home users, you don’t need to turn your house into a SOC.
Your Wi-Fi/router platform may already provide:
per-device traffic statistics,
device lists,
connection histories,
security alerts,
or isolation options.
Occasionally looking at them isn’t the worst idea humanity has produced.
Segmentation Suddenly Looks Pretty Smart
I am a huge fan of not allowing everything to talk to everything.
Your smart lightbulb does not need unrestricted access to your laptop.
Your television doesn’t need to initiate connections to your NAS.
Your robot vacuum does not need to participate in Active Directory.
Honestly, if your vacuum is domain-joined, we need an entirely different blog post.
CISA has long recommended placing IoT devices onto separate, dedicated networks where practical. CISA
At home, that can mean:
An IoT Wi-Fi network or VLAN.
Computers and phones on another.
Guest devices somewhere else.
Then restrict communication between those networks to what’s actually necessary.
Some smart-home ecosystems need local discovery protocols, so blindly blocking everything can break features like casting or device control.
That’s solvable.
It doesn’t mean the television deserves diplomatic immunity.
And Turn Off the Stuff You Aren’t Using
Anthropic’s replication experiment intentionally relied on an unauthenticated ADB interface.
That made the lab environment easier to compromise than a properly secured real-world device. Anthropic
There’s an obvious lesson in there.
If you’re not using:
ADB.
Developer mode.
Remote administration.
Telnet.
SSH.
UPnP.
Some random vendor debug service whose purpose is apparently “future regret.”
Turn it off.
CISA’s exposure-reduction guidance recommends minimizing unnecessary internet exposure, changing default credentials, keeping systems patched and monitoring inbound and outbound traffic. CISA
Cybersecurity occasionally consists of very sophisticated techniques.
And occasionally it consists of:
Stop leaving the debug port open.
Both count.
Patch the Damn Television
One of the reasons IoT has historically been such a disaster is that consumers don’t think of appliances as computers.
Nobody used to say:
I need to install security updates on the toaster.
Fair.
But if the toaster has:
Wi-Fi,
an operating system,
cloud credentials,
a processor,
memory,
and a network stack…
Congratulations.
You bought a computer that also makes toast.
NIST’s IoT baseline specifically calls for secure software-update capability and for updates to be restricted to authorized entities and verified before installation. NIST Computer Security Resource Center
For consumers:
Turn on automatic updates where you trust the vendor.
Check occasionally that devices are still supported.
And when the manufacturer stops providing security fixes, consider that when deciding how long that device deserves access to your network.
A $39 streaming box abandoned by its manufacturer in 2024 probably shouldn’t become a permanent member of your network architecture.
Default Passwords Should Have Died Years Ago
Mirai demonstrated this in 2016.
We apparently required additional reminders.
CISA continues to push manufacturers to eliminate default passwords entirely because attackers routinely use them to compromise exposed systems. CISA
The UK went further.
Since April 2024, consumer smart-device manufacturers selling covered products in the UK have been required to avoid easily guessable universal default passwords, provide a vulnerability-reporting contact and disclose how long products will receive security updates. National Cyber Security Centre
That’s the direction we need.
Security shouldn’t depend on Grandma remembering to change admin/admin on her new video doorbell.
The manufacturer should never have shipped it that way.
What Can Home Users Actually Do?
You do not need a rack full of firewalls and a SIEM because you bought a smart thermostat.
Although I know several people who will take that as a challenge.
The practical version is much simpler:
Use unique passwords.
If the vendor has an account associated with the device, protect it with a unique password and MFA where available.
Keep firmware current.
Enable automatic security updates if the manufacturer has a credible update process.
Separate IoT devices from important computers.
Use an IoT or guest network if your router supports it.
Disable unnecessary services.
Developer modes, remote administration and unnecessary inbound access shouldn’t remain enabled just because the menu exists.
Replace abandoned devices.
If something hasn’t received a security update in several years and the manufacturer has disappeared into the internet mist, treat that as a risk.
Know what’s connected.
Every once in a while, look at your router’s device list.
You don’t need to recognize every MAC address from memory.
But you should probably have some idea why you own 47 internet-connected things.
And Pay Attention When You Buy the Next Thing
This is where consumers have more influence than we sometimes realize.
Before buying another $29 smart widget, look for:
A published security-update period.
Automatic updates.
Unique per-device credentials.
MFA on its cloud account.
A real vulnerability-disclosure program.
A manufacturer that appears likely to still exist next Thursday.
NIST’s consumer IoT profile specifically focuses on things like secure configuration, access control, software updates, data protection and visibility into device security state. NIST Computer Security Resource Center
The FCC has also created the voluntary U.S. Cyber Trust Mark program, which is intended to identify consumer IoT products that meet baseline cybersecurity standards. Products authorized to carry the mark use a QR code linking consumers to additional security information. Where you encounter it, it’s another useful signal rather than having to evaluate firmware-support policies while standing in Best Buy. FCC Docs
Not perfect.
Better than selecting your home security camera based entirely on:
37% OFF — TODAY ONLY.
For Businesses, This Is Mostly an Architecture Problem
Enterprises have more tools.
They also have considerably more IoT garbage.
Cameras.
Printers.
Conference-room systems.
Badge readers.
Digital signs.
Environmental sensors.
Industrial equipment.
TVs.
Network appliances.
Building systems.
And that mysterious Raspberry Pi under someone’s desk that apparently runs something “important.”
Start with the basics:
Inventory IoT and edge devices.
You cannot secure assets you don’t know exist.
Segment them.
Do not put cameras and employee laptops into the same trust zone because somebody ran out of VLAN numbers.
Restrict east-west communication.
If two device classes have no business talking to each other, don’t let them.
Control outbound access.
An appliance that only needs three vendor cloud endpoints doesn’t necessarily need the entire internet.
Monitor network flows.
Large downloads, scanning behavior and sustained unusual device-to-device connections are precisely the kinds of signals Anthropic believes an AI replicator would generate. Anthropic
Quarantine automatically when confidence is high.
If a low-trust IoT device suddenly behaves like malware, moving it into isolation while someone investigates is considerably better than creating a Jira ticket that gets reviewed Tuesday.
Honeypots May Become Surprisingly Useful
Anthropic also suggests something defenders have used for years:
honeypots.
Put decoy vulnerable-looking devices into the environment.
If malware attempts to infect them, defenders can capture the payload and study it.
For an AI replicator, that could expose:
Model files.
Prompts.
Agent harnesses.
Scripts.
Network behavior.
Propagation logic.
Anthropic argues that once a replicator is identified, those captured artifacts could help defenders characterize it and build broader detection. Anthropic
There’s something wonderfully satisfying about setting up a fake vulnerable toaster and waiting for malware to introduce itself.
Cybersecurity does occasionally offer entertainment.
ISPs Could Help Too
There’s precedent here.
Anthropic points to research involving remediation of Mirai infections where an ISP quarantined known infected subscribers and redirected them toward cleanup instructions.
That approach cleared about 92% of infections within 14 days, compared with 74% among customers who weren’t notified. Anthropic
That suggests a future AI worm wouldn’t necessarily require every consumer to suddenly become a malware analyst.
ISPs could identify anomalous propagation patterns.
Notify customers.
Restrict compromised networks.
Provide remediation paths.
Coordinate indicators across providers.
It wouldn’t completely eradicate a widely distributed worm.
But it could push the reproduction rate low enough that the outbreak shrinks instead of growing.
Anthropic literally frames the problem using epidemic math:
Get R₀ below 1.
Apparently even malware has entered its epidemiology era.
Manufacturers Have the Biggest Responsibility
Here’s where I think we need to resist the usual cybersecurity reflex.
When millions of insecure IoT devices get compromised, the answer cannot always be:
Consumers should have configured them better.
No.
If the average person buys a smart television, they should not be expected to:
disable an undocumented management interface,
build a firewall policy,
monitor east-west traffic,
reverse engineer firmware,
and consult NISTIR 8259A before watching The Bear.
CISA’s Secure by Design guidance puts responsibility where it belongs:
manufacturers should ship products secure by default. CISA
That means:
No universal default passwords.
No unnecessary exposed services.
Secure, signed updates.
Reasonable support periods.
Transparent end-of-support dates.
Useful logging.
Vulnerability disclosure.
Secure recovery mechanisms.
Authentication around management interfaces.
The ability for owners and enterprises to identify and isolate devices.
NIST updated its foundational IoT-manufacturer guidance in April 2026 specifically because product cybersecurity needs to be built in rather than bolted on by customers afterward. NIST Computer Security Resource Center
That principle becomes even more important if malware gets smarter.
AI Doesn’t Make Bad IoT Security Good
This is probably the part of the story I find most interesting.
Anthropic hasn’t discovered some completely new cybersecurity problem.
They’ve demonstrated what could happen when a new capability lands on top of an old one.
We already have:
Millions of poorly secured devices.
Weak or default credentials.
Abandoned firmware.
Unnecessary network exposure.
Flat home and business networks.
Minimal logging.
Very little visibility.
Botnets with millions of infected hosts.
Now imagine adding malware that can say:
This isn’t the device I expected.
Give me a minute.
That’s the change.
We Probably Don’t Need an “AI Worm Security Product”
Please don’t take that as a challenge, cybersecurity marketing departments.
Someone is already registering the domain.
Most of the defenses against the threat Anthropic describes aren’t particularly exotic.
Asset inventory.
Patching.
Secure defaults.
Network segmentation.
Least privilege.
Egress filtering.
Traffic baselining.
Anomaly detection.
Rapid quarantine.
Honeypots.
Vendor accountability.
In other words:
Cybersecurity.
The AI part changes the attacker.
It doesn’t repeal networking.
If an infected television needs to send several gigabytes to another device, packets still have to cross the network.
If it scans for targets, the scans still happen.
If it attempts ADB connections, those connections still exist.
If fifteen devices start talking continuously to perform distributed inference, switches and routers still see the traffic.
AI may make malware smarter.
It doesn’t make Ethernet magical.
Not yet, anyway.
Don’t Fear the AI Worm. Fix the Environment It Would Need.
That’s where I land on Anthropic’s research.
I don’t think this is a reason to panic.
In fact, the research gives defenders something valuable:
warning.
We can see the capability developing before it becomes a common real-world threat.
That’s a luxury cybersecurity doesn’t always get.
Anthropic hasn’t shown us some unstoppable digital organism.
It showed us that the gap between:
malware that follows instructions
and
malware capable of figuring things out
may be getting smaller.
And it showed us which environment is likely to be attractive first.
Cheap.
Connected.
Poorly maintained.
Weakly monitored.
Frequently exposed.
That sounds less like science fiction and more like the Internet of Things aisle at your favorite electronics store.
So maybe the takeaway isn’t:
AI is coming for your refrigerator.
It’s:
We’ve spent years connecting under-secured computers to everything from refrigerators to doorbells, and smarter malware is giving us another reason to finally take that seriously.
Your smart oven isn’t plotting an escape.
Your television doesn’t secretly want compute independence.
The lawnmower has no opinion on humanity.
Probably.
But every connected device is still a computer.
And every computer deserves a basic level of security.
AI didn’t change that rule.
It may just make ignoring it considerably more expensive.
Sources & Further Reading
Anthropic’s original Frontier Red Team research is the primary source and is refreshingly candid about both the results and limitations. It describes the real Android TV-box distributed-inference demonstration, the simplified emulated replication experiment, the current capability gap, estimated replication speeds and proposed blue-team defenses. Anthropic
BleepingComputer’s October 13 coverage accurately captures the primary research while making the crucial point that Anthropic did not demonstrate a fully autonomous AI worm reproducing end-to-end across real IoT devices. BleepingComputer
Ars Technica independently reviewed the work and similarly emphasizes that substantial technical obstacles remain even though the individual capabilities are increasingly plausible. Ars Technica
For historical perspective, the definitive USENIX analysis of Mirai shows how simple exploitation of weak/default credentials allowed a traditional IoT worm to reach hundreds of thousands of devices years before generative AI entered the picture. USENIX
Cloudflare’s current reporting on Aisuru-Kimwolf demonstrates that IoT botnets remain a very real problem today, with an estimated 1–4 million compromised hosts in that ecosystem. Cloudflare
NIST’s IoT cybersecurity guidance and CISA’s Secure by Design work provide the less exciting but far more useful answer to the problem: secure configuration, authenticated updates, elimination of default credentials, reduced exposure, monitoring and products designed so consumers don’t need to become network-security engineers merely to own a television.