Anthropic's internal safety unit says the artificial intelligence models it tested this month cannot yet spread on their own across the billions of poorly secured smart devices connected to the internet — but the company warned that the gap between today's systems and that capability could close within months.
In a report published Oct. 12, the AI lab's Frontier Red Team described a series of tests built around one specific threat: a model that, once it gained a foothold on an internet-connected device, could configure itself to run on unfamiliar hardware, hunt for the next vulnerable machine, and keep spreading without a data center or a human operator directing it.
Small models, big gaps
The researchers found that models with fewer than 30 billion parameters, small by current industry standards, could already carry out many of the individual steps a self-replicating program would need, from scanning a network to installing the software required to run themselves on new hardware. None of them, however, could reliably string every step together into a full, working chain on genuinely secured devices.
To probe the upper limit of what is possible, Anthropic stripped out some of the protections that real hardware would normally have, including, in one configuration, an unauthenticated debugging port, and reran the test on a firewalled network of eight Android emulators. Under those relaxed conditions, a more capable model completed the entire replication sequence from start to finish. In a separate, physical demonstration, the team got a 26-billion-parameter model running across a cluster of 15 cheap, off-brand Android TV boxes, processing at a crawl of roughly 0.39 tokens per second.
Anthropic framed the results as an upper bound rather than evidence that a self-spreading AI program already exists on the public internet. Still, extrapolating from the pace at which smaller models have gained capability, the company's researchers projected that a model small enough to run efficiently on consumer hardware could cross the threshold needed for reliable self-replication by the end of 2026.
Why smart TVs and routers, not laptops
The devices Anthropic focused on were not corporate servers but the kind of hardware most households never think about: Android TV boxes, smart-home gadgets and other internet-of-things equipment that ships with weak default credentials and rarely receives security updates. A model that took hold on that class of device would, in theory, have no central point to shut it down and, unlike conventional malware written for one target, could improvise its way onto hardware its creators never anticipated.
Experts split on how worried to be
Anthropic's post raised the prospect of a rogue AI spinning up a botnet that could resist takedown attempts and even probe its way into data centers, a scenario that drew open scorn from Ciaran Martin, the former head of Britain's National Cyber Security Centre, who called the paper "an interesting technical paper with a more than hint of vendor exaggeration." Running a small model on cheap televisions, he added, "does not a security crisis make."
Others were less dismissive. Zhengxiong Li, a researcher at the University of Colorado Denver, said that while Anthropic's tests were conducted under controlled, simplified conditions, he still found it unsettling that a model could act as a self-replicating "worm" at all. Jessica Ji of Georgetown's Center for Security and Emerging Technology took a middle position, arguing the scenario is best understood as hypothetical rather than predictive, since no one yet knows how likely it is to materialize.
"'We managed to run a small model on cheap TVs,' does not a security crisis make."
— Ciaran Martin, former head of the UK's National Cyber Security Centre
What happens next
Anthropic has not announced new product restrictions tied to the findings and says the point of the exercise was to get ahead of a risk before it becomes real rather than to respond to an active one. The company is urging device makers and network operators to close the kinds of gaps its researchers exploited, removing unauthenticated services, replacing default passwords and segmenting IoT devices from the rest of a network, well before any model is capable of exploiting them unassisted. The findings land amid a broader push in Washington to set rules for how frontier AI companies disclose safety testing, and researchers said they expect the debate over how seriously to weigh self-replication risk to continue as rival labs publish their own red-teaming results ahead of their next model releases.
