Anthropic is warning that the next major AI security problem may not need a data center—or even a particularly large model. The company’s Frontier Red Team says increasingly capable small models could soon copy themselves across internet-connected appliances and low-cost gadgets, transforming vulnerable IoT hardware into a distributed AI platform. Anthropic’s research says the capability may be only months away, while Ars Technica’s report places the warning in the context of potential computer worms that spread without human intervention.
The researchers are describing a “weight-based replicator”: malware that carries an AI model’s weights and the software needed to run them onto newly compromised machines. Its job would involve finding another device, gaining access, installing the payload, starting an inference server, and then launching another copy of the process. Unlike a conventional botnet command center, such a system could potentially continue operating without one central server to disable—and might adapt its approach when it encounters unfamiliar hardware.
Anthropic did not demonstrate a free-roaming worm on the public internet. Instead, its researchers tested individual pieces of the problem in controlled environments. A 9-billion-parameter model established inference on eight of nine hardware types, while a separate demonstration distributed Google’s Gemma4-26B-A4B across 15 inexpensive Android TV boxes with 4 GB of RAM each. The boxes worked together through pipeline parallelism, but generated only about 0.3 to 0.39 tokens per second—far slower than a conventional data-center deployment.
The most striking result came from a firewalled test network of eight Android 15 emulator nodes. Using simplified access through unauthenticated Android Debug Bridge ports, GLM-5.2 completed the full replication sequence across all eight nodes in four of five trials and reached seven in the remaining trial. The model was asked to set up Llama 3.1 8B on infected systems rather than reliably host and reproduce itself, however, and the researchers acknowledge that the experiment made cyber exploitation considerably easier than it would be on ordinary consumer hardware.
That distinction matters. Anthropic’s findings show that the orchestration and inference challenges are becoming tractable, not that a self-sustaining AI worm is already loose. The company largely set aside target discovery and exploitation, pointing to earlier research showing that small models can perform cyber operations when supplied with suitable tools. In a separate 17-node experiment where inference setup was scripted, even a 3-billion-parameter model reached roughly half the available hosts—evidence of progress, but not proof of an autonomous real-world attack.
The threat becomes more concerning because IoT botnets already provide a precedent for enormous numbers of poorly secured devices. Anthropic cites the Mirai-era experience to argue that provider quarantine can be effective: notifying and isolating infected subscribers cleared 92 percent of infections within 14 days in one cited response, while quarantine without notification cleared 74 percent. A weight-based AI replicator could likewise be slowed by network monitoring, device isolation, secure defaults, and manufacturer patches, even if completely eradicating it would require coordination across many internet providers.
Anthropic’s forecast is based on the historical improvement rate of open-weight models with 30 billion parameters or fewer, using the Epoch Capabilities Index as a rough proxy. The researchers say those models could reach the capability level represented by GLM-5.2 by the end of 2026, with smaller self-hosting replicators potentially following soon afterward. That timeline is an extrapolation rather than a release schedule, and the company stresses that real devices are more heterogeneous, access is harder, and the projected worm could take days to reproduce. Still, the warning gives security teams a clear target: keep the effective reproduction rate below one new infected device per infected device before today’s slow laboratory experiment becomes tomorrow’s household botnet.
