Anthropic Study Warns Small AI Models Could Soon Spread Across Consumer Smart Devices

Autonomous AI replication may no longer be a risk confined strictly to massive data centers. A study conducted by Anthropic researchers William Zhou and Daniel Freeman warns that small AI models could soon possess the capability to spread autonomously across poorly secured everyday consumer electronics, such as smart TVs, connected refrigerators, and robot vacuums.

Unlike conventional malware, an "AI worm" would bundle its model weights as part of the payload, running inference directly on compromised hardware. This would enable the software to inspect unfamiliar devices autonomously and configure its own operating environment to persist and spread further.

Successful Tests on $55 TV Boxes

To evaluate whether consumer-grade electronics could support such operations, the researchers distributed a Gemma4-26B-A4B model across 15 standard Android TV boxes. Each unit cost roughly $55 and carried 4 gigabytes of RAM, with each box executing a slice of the model's layers. While inference ran slowly, the distributed deployment worked.

The team broke autonomous replication into four distinct phases:

1. Scanning local networks for vulnerable devices.
2. Gaining unauthorized access.
3. Establishing a functioning AI runtime on the target device.
4. Spreading onward to new nodes.

Anthropic researchers deliberately bypassed the actual intrusion stage, noting that earlier studies had already verified small models can handle basic exploitation tasks. Instead, they concentrated on the most complex technical hurdle: whether a model could independently establish a working AI environment on completely unfamiliar hardware.

GLM-5.2 Completes the Replication Chain

The experiments revealed that small models already perform single configuration steps effectively. For example, a 9-billion-parameter model managed to install an environment running Llama3.1-8B on 8 out of 9 tested hardware types.

However, executing the end-to-end chain—from scanning to completing a self-sustaining copy on a new target—proved too difficult for most models tested. Only GLM-5.2 reliably completed the full replication sequence, successfully infecting all eight test nodes in four out of five experimental runs. The other three models evaluated failed to spread beyond the initial starting node.

The researchers also tested an artificial evolution mechanism, allowing model instances to pass diagnostic notes on successful and failed strategies to their successors. When applying this technique to Qwen3.5-9B, its setup success rate rose significantly, climbing from 45 percent in the first generation to as high as 84 percent in later iterations.

Slow "Digital Slime Molds" Without a Central Kill Switch

At present, no single model is both small enough to fit easily onto resource-constrained consumer gadgets and capable enough to orchestrate end-to-end autonomous replication in the wild. However, given the rapid trajectory of model efficiency, the authors project that models could bridge this gap by the end of 2026.

An AI worm of this variety would operate slowly. Depending on the model, initial setup on a newly compromised device took between 28 and 150 hours during testing. The researchers likened the behavior to a "digital slime mold"—sluggish, but extraordinarily resilient due to its decentralized structure.

Traditional botnets typically rely on narrow code targeting specific architectures. For instance, the Kimwolf botnet infected more than two million devices, primarily Android TV boxes. An AI-driven botnet, by contrast, could adaptively reconfigure itself to run across diverse, heterogeneous hardware. While a network of two million IoT devices would provide compute equivalent to only about 40 specialized AI accelerator chips, it would lack any centralized command infrastructure or single kill switch.

Mitigations remain feasible but require coordinated action. Network-level quarantines by internet service providers (ISPs) previously helped neutralize the Mirai botnet, clearing 92 percent of infections within 14 days. Legislative measures, such as the UK ban on default device passwords, also help shrink attack surfaces, though the researchers caution that adaptive AI agents could eventually learn to bypass basic defensive barriers.

Warnings of Internet-Scale Disruption

Anthropic CEO Dario Amodei has sounded alarms over this attack vector, warning that an autonomous swarm "could within 6 to 12 months be capable of taking over the entire internet with a persistent botnet, potentially causing hundreds of billions of dollars in damage."

Amodei emphasized that the broader AI industry must treat replication and exploitation vulnerabilities proactively rather than viewing isolated security incidents as one-off anomalies.

"As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control," the researchers concluded, warning that early, slow-moving replicators could foreshadow significantly faster and more aggressive variants.