LeadershipNot yet confirmed elsewhere1 publisher2 min readPublished
Anthropic researchers say small AI models may be months from self-replicating on IoT devices
Anthropic's red team says small AI models may be months from self-replicating on commercial IoT devices. In its evals a 9B model got inference running on 8 of 9 hardware types, though end-to-end replication came from GLM-5.2 and stronger models.
The Board Room · Leadership desk
Gemma4-26B-A4B ran at 0.39 tokens per second across 15 Android TV boxes; a 9B model got inference running on 8 of the 9 hardware types tested; models of 30B parameters and under complete many replication steps; the boxes cost roughly $825.
- 0.39 tokens/second Gemma4-26B-A4B speed over 15 Android TV boxes, claim 4
- 8 hardware types Hardware types where a 9B model got inference running, claim 1 of the 9 hardware types tested
- 30 B parameters Models this size and under do many replication steps, claim 2 make mistakes composing them end to end
- 825 dollars, roughly Box hardware cost, claim 12
| Figure | Value | Note | Claim |
|---|---|---|---|
| Gemma4-26B-A4B speed over 15 Android TV boxes | 0.39 tokens/second | 4 | |
| Hardware types where a 9B model got inference running | 8 hardware types | of the 9 hardware types tested | 1 |
| Models this size and under do many replication steps | 30 B parameters | make mistakes composing them end to end | 2 |
| Box hardware cost | 825 dollars, roughly | 12 |
What happened
- Models of 30B parameters and under can already complete many individual replication steps, though they make mistakes when composing them end to end.
- The worm the authors describe would carry its model weights with it or re-download them from a public hub, so the weights become part of the malware payload.
- To test the hardware side, the team ran Gemma4-26B-A4B across 15 off-brand Android TV boxes it bought and networked, at 0.39 tokens per second.
- The team largely skipped the exploit stages, citing CyberGym, ExploitBench and adaptive worms as earlier evidence that small models can exploit systems given the right tools.
Why it matters
- constraint A response built around seizing a server or blocking a controller has nothing to act on, so in our view containment falls to whoever owns the devices.
- exposure Commercial IoT hardware on a network is a candidate host for a model, because the authors say expensive accelerators are not strictly necessary to run one.
- capability The authors say that, unlike non-AI malware, a replicator could figure out unfamiliar devices on its own. In our view that widens the set of hardware it can reach.
- decision Operators with unmanaged connected devices have to decide whether to act on an extrapolation. Waiting for a small model to show the full chain means acting after the capability level is reached, and the authors say small weight-based replicators may follow soon after.
Every figure here is Anthropic's own, from the post by William Zhou and Daniel Freeman [15], and the date it offers depends on a condition the authors state themselves. They wrote: "If small models improve at their historical rate, they'll match this capability level by the end of this year." [16] The measured result at 9B is narrower: inference ran on eight of nine hardware types, which leaves one type where it did not [14]. We think the date is checkable. A model of 30B parameters or under completing the whole chain in evals like these would show the projection holding, and continued composition errors [2] would show it slipping.
The authors pair two properties that pull against each other. Of such a replicator they wrote: "A replicator like this would be challenging to shut down, since there's no centralized point to shut off - though it may be slow (with a doubling time of days)." [18] That is a trade-off between having no off switch and a growth rate counted in days. In our view the doubling time is the figure a defender can plan around, because it sets the pace at which a response has to be organised.
The cost side is small. Fifteen boxes at about $55 each come to roughly $825 of hardware [12], and the authors describe such devices as "cheap and typically poorly defended" [5]. At 0.39 tokens per second the cluster emits a token about every 2.6 seconds [13]. We do not know yet whether a cluster at that speed can drive an agent through the full replication chain.
The scope of the post is deliberately narrow. Small weight-based replicators are one route, chosen because the authors call it a near-term threat model that can be investigated directly [8]. They name others: stealing access such as API keys or platform credentials to spin up hosts, or paying for inference through legitimate work such as digital freelancing [11]. They add that a swarm of different models on different hardware, using a variety of replication schemes, might be a more realistic worst case [9]. Those routes do not depend on small models fitting on a TV box, so the timeline in this post bounds only one of them.
What to watch
- A model of 30B parameters or under completing the whole replication chain in an eval like these, instead of making composition errors.
- Independent reproduction of the 8-of-9 hardware result or the 15-box Gemma4 demo by a lab other than Anthropic.
- Any test that chains the exploit stages with inference setup in one run, since the post leaves exploitation to earlier papers.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In the team's evals, a 9B model got inference running on 8 of the 9 hardware types tested.
- [2]
Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end.
- [3]
In the team's simplified evals, GLM-5.2 and stronger models are capable of end to end replication.
- [4]
The team ran Gemma4-26B-A4B distributed over 15 inexpensive off-brand Android TV boxes (about $55 each) that it bought and networked together, at 0.39 tokens per second.
- [5]
The authors describe IoT devices as cheap and typically poorly defended.
- [6]
The team largely ignores the cyber exploit element of replication (the first two stages) because earlier papers CyberGym, ExploitBench and adaptive worms already show that small models are capable of cyber exploits, especially when given the right tools.
- [7]
An AI worm could carry its model weights with it as it reproduces, or re-download them from a public hub, and then run inference directly on compromised hardware, so the weights would become part of the malware payload.
- [8]
The authors focus on small weight-based replicators because it is a near-term threat model that can be investigated directly.
- [9]
A swarm of different models deployed on different types of hardware using a variety of replication schemes might represent a more realistic worst case scenario attack.
- [10]
Datacenter GPUs would be a clear, high-value target for such malware, but expensive accelerators are not strictly necessary; a distributed botnet of IoT devices could provide enough compute to run a capable model.
- [11]
Other ways AI worms might propagate include stealing access (for example API keys or platform credentials) to spin up hosts, or paying for inference through legitimate work such as digital freelancing.
- [12]
Fifteen boxes at about $55 each come to roughly $825 of hardware.
- [13]
At 0.39 tokens per second the cluster produces one token about every 2.6 seconds.
- [14]
The 9B model got inference running on eight hardware types and not on one of the nine tested.
- [15]
William Zhou and Daniel Freeman of Anthropic's Frontier Red Team wrote that their experiments suggest small AI models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes.
ReportedContestedSource: Anthropic Frontier Red Team post by William Zhou and Daniel Freeman2 sources— create a free account to open themView cited source - [16]
"If small models improve at their historical rate, they'll match this capability level by the end of this year."
ReportedContestedSource: William Zhou and Daniel Freeman, Anthropic Frontier Red Team post2 sources— create a free account to open themView cited source - [17]
The authors say small weight-based replicators may be possible soon after small models match the end-to-end capability level.
ReportedContestedSource: Anthropic Frontier Red Team post2 sources— create a free account to open themView cited source - [18]
"A replicator like this would be challenging to shut down, since there's no centralized point to shut off - though it may be slow (with a doubling time of days)."
ReportedInsufficientSource: William Zhou and Daniel Freeman, Anthropic Frontier Red Team postView cited source - [19]
Unlike non-AI malware, an AI replicator could also figure out unfamiliar devices on its own.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.