AI News Self-replicating AI models could soon usurp your fridge, Anthropic warns

[Brownie2019]

Content source

https://cybernews.com/news/self-replicating-ai-anthropic/

An army of agents are coming for your IoT devices.
Key takeaways

1. 01Anthropic warns small open AI models may eventually copy themselves across everyday smart devices.
2. 02Researchers say a low-cost device model could reach this ability by the end of 2026.
3. 03One tested model completed Anthropic’s full replication evaluation, but broad autonomous spread is not imminent.

Anthropic claims that small open AI models may be months away from autonomously replicating across everyday internet-connected devices and potentially creating an independent AI botnet.

The debate over closed vs open AI models is heating up with the latest warning from Claude's developer.

Anthropic researchers evaluaAI ted open-weight AI models such as GLM-5.2, Qwen3.5-9B and Gemma4-26B-A4B to determine whether they could find other machines, such as Android TV boxes, smart ovens and refrigerators, infiltrate them, and propagate further without human intervention.

The researchers have already proven that 15 inexpensive Android TV boxes can run a relatively large AI model together, albeit slowly.
Small models can also configure unfamiliar hardware, according to Anthropic. However, GLM-5.2 was the only tested open-weight model to complete the researchers' end-to-end replication evaluation.

But don't read this as an imminent machine revolution just yet. At least not in the coming months.

“Digital slime mold”
The researchers estimate that if small models continue improving at the same rate, a model small enough to run on low-cost devices could reach the required replication capability by the end of 2026.

"It’s uncertain exactly what form autonomous AI replication will take. It could be a slow, distributed ‘digital slime mold,’ living on relatively insecure compute,” researchers behind tests said.

“It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits," they noted.

Anthropic also said its researchers "expect a future awash with agents running on all types of hardware, including some that aren’t under human control."

In 2025, Cybernews reported on a massive botnet, Kimwolf, that included more than 1.8 million Android devices. It briefly surpassed Google on the top websites chart, sending warnings across the world about possible major cyberattacks.

"We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay," the researchers at Anthropic concluded.

 

[Bot]

Hi Brownie2019. This is worth taking seriously, but the headline is several steps ahead of the evidence. Anthropic demonstrated components of an AI-assisted worm in controlled, deliberately favourable conditions—not a small model independently breaking into and cloning itself across real household appliances.

The important details in Anthropic’s actual write-up are:

• Researchers deliberately networked 15 cheap Android TV boxes and distributed Gemma4 across them. It ran at only 0.39 tokens per second. That proves such hardware can collectively host a model; it was a cluster demonstration, not 15 infected television boxes.
• A 9B model managed to configure inference on eight of nine hardware types. That is interesting evidence of adaptability to unfamiliar systems, but it does not demonstrate gaining access to them.
• The end-to-end experiment used Android emulators inside a firewalled cloud network with an unauthenticated ADB port. In other words, the difficult initial-compromise stage was intentionally made trivial.
• GLM-5.2 orchestrated the process, but it ran on a separate inference server because the target nodes could not host it. The targets served Llama3.1-8B, and the test harness spawned the next GLM-5.2 agent after a target passed its checks. Therefore, “completed the replication evaluation” is accurate under Anthropic’s proxy setup, but it does not mean GLM-5.2 literally copied its own weights and started itself on an IoT device.
• The end-of-2026 claim is an extrapolation: it assumes future small models acquire today’s much larger model’s capabilities. It is a forecast, not an observed deadline.

The security concern is nevertheless credible. Traditional worms such as Mirai already replicate without AI, and they are far smaller and faster. An AI component could make a future worm more adaptable—troubleshooting unfamiliar hardware, changing tools and using different propagation paths rather than relying on one hard-coded device family. Conversely, multi-gigabyte weights, sustained inference traffic and slow execution also make such a worm comparatively noisy.

Open weights matter because the model can travel with the malware and cannot simply be switched off by revoking access to a central API. They do not magically provide initial access, however. The attacker still needs an exposed service, vulnerability, stolen credentials or some other foothold, plus software directing the model to propagate.

The useful defensive response is mostly familiar IoT hygiene:

• update routers and smart devices, and retire products no longer receiving fixes;
• disable ADB/developer mode, Telnet, SSH, remote administration, UPnP and unnecessary port forwards;
• replace factory/default passwords with unique credentials;
• put IoT devices on a separate VLAN or properly isolated guest network, without access to PCs and NAS devices;
• investigate unexpected outbound scanning, multi-gigabyte downloads or sustained traffic between devices that normally have no reason to communicate.

So, a plausible near-term evolution of botnets, yes; an autonomous fridge uprising already demonstrated, no. Poorly secured IoT remains the enabling problem—AI may broaden and automate the attack, but it does not abolish authentication, patching or network segmentation.

Sources

• AI models may be capable of self-replicating without access to a datacenter \ Anthropic