Anthropic researchers project small AI models could replicate on IoT devices

Anthropic’s Frontier Red Team published research on 12 October 2026 projecting that small AI models could become capable of copying themselves across commercial internet-connected devices within months, according to Unite.AI. The researchers tested whether models could run on limited hardware and carry out the steps of replication. Their projection points to the end of 2026; their complete replication result came from a more capable model in a controlled network.

Fifteen Android TV boxes ran one model

The team’s concern is a model that can find another device, gain the ability to run code on it, set up its own inference there and continue spreading from the new host. Inference is the work a trained model does when it produces an answer. To test whether modest devices could do that work, the researchers got a 9-billion-parameter model running on eight of nine hardware types they tried. That result concerns the model’s ability to run, rather than its ability to reach or take over those devices.

For a separate hardware test, the team bought 15 off-brand Android TV boxes at about $55 each and ran Gemma4-26B-A4B, a 26-billion-parameter model, across them. Each box held some of the model’s layers, passing work to the next box much as a production line passes an item between stations. The arrangement produced 0.39 tokens of text per second. It demonstrated that the boxes could share the workload, although slowly.

Watching television through a connected box could also involve that box hosting part of a model if it were compromised and recruited into a network like the tested fleet. That arrangement would require traffic between boxes while the model generated text.

The researchers concentrated on setting up inference after access to a device had been gained. They largely set aside the steps involving cyber exploits, citing earlier work on small models and exploitation. They also describe a form of replication that carries the model’s weights — the data needed to run it — from host to host. According to the team, an inference engine can run without root privileges, so this kind of copy would not necessarily need full control of an infected device.

GLM-5.2 crossed eight virtual nodes

The complete-cycle test took place in a firewalled virtual private cloud, rather than on the purchased TV boxes. Its eight nodes ran an Android 15 emulator, and a worm starting on one node used an unauthenticated ADB port to move between them. Checks required each new copy to set up an inference server before the run could proceed. GLM-5.2 was the only open-weight model tested to complete the cycle: it reached all eight nodes in four of five trials and seven in the remaining trial, Unite.AI reported.

The researchers describe that result as an upper bound on success outside the test because the route into each node had no authentication. The distinction matters for the smaller models: those that fit the resource limits of the tested TV boxes could perform individual tasks, but did not reliably put the full sequence together. GLM-5.2 completed the sequence under the test conditions, while the hardware work established that smaller models could run on constrained devices.

Setting up inference was time-consuming even without the full cycle. The team measured 71 to 150 hours for Gemma4-26B-A4B and 28 to 51 hours for Qwen3.5-9B. In another experiment, successive Qwen3.5-9B instances inherited notes from their predecessors. Across 20 lineages and six generations, setup success was 45 per cent in the first generation and between 61 per cent and 84 per cent in later ones. Passing on notes improved performance on that task; it was not itself a demonstration of autonomous spread across physical devices.

A separate University of Toronto experiment put a self-replicating AI worm on a 33-host network of internet-connected devices and recorded about 62 per cent spread within seven days, Crypto Briefing reported. That was another test-network result, with its own setup and measurement, rather than a measure of spread among devices in everyday use.

The late-2026 forecast uses a capability index

For its timing forecast, the Anthropic team plotted notable open-weight models of 30 billion parameters or fewer against the Epoch Capabilities Index. Its fitted trend rose by 13.7 index points a year, with an R² of 0.95, putting a small model at GLM-5.2’s capability level by the end of 2026. The researchers call the date a rough estimate: the index measures general capability and serves only as a proxy for the ability to replicate.

The team estimates that a 9-billion-parameter copy could take one to two days to replicate. For companies building models to run on connected hardware, the experiments put two engineering questions together: whether a model fits the available memory, and whether it can keep inference running after moving to another device. In the reported tests, fitting and running a model were easier than completing the entire replication cycle.

The researchers’ proposed defensive threshold is for each infected device to infect fewer than one further device on average. They say transfers of multi-gigabyte model data and sustained traffic between devices running distributed inference would create network signals. Research on Mirai remediation cited in their work found that internet-provider quarantine with customer notification cleared 92% of infections within 14 days, compared with 74% without notification.