ANTHROPIC has warned that advances in small, weight-based AI models could enable self-replicating malware that operates across Internet-of-Things devices such as smart fridges and vacuum cleaners. The company suggested that by next year smaller models may autonomously self-replicate on a variety of IoT hardware, potentially creating computer worms that spread without human intervention.
While an experiment conducted by Anthropic showed significant obstacles to achieving end-to-end replication, the findings raise concerns about new forms of malware that could tailor exploits and payloads to individual devices as they propagate.
The researchers tested lightweight models on low-cost Android TV boxes and other IoT hardware, using quantisation and workload-splitting into shards to achieve inference. For example, Gemma4-26B-A4B required 15 boxes with 4GB each to reach inference, while Qwen3.5-9B could adapt to eight of nine hardware types.
Despite progress, none of the small models yet achieved full autonomous replication—from discovering targets to deploying payloads—but larger 30B-parameter models could perform many replication steps, albeit with mistakes in end-to-end execution. The study notes a slow replication pace and highlights risk factors such as an unauthenticated Android Debug Bridge on test devices.
Experts emphasised that the research does not prove autonomous self-replication would occur, and calls for reproducible setups to better understand the implications.