Anthropic Warns Small AI Models May Be Months Away From Self-Replicating Across Smart Ovens and Cheap Android TV Boxes

Anthropic is warning that small AI models could soon be able to copy themselves across consumer IoT devices, from off-brand Android TV boxes to smart ovens, forming distributed botnets that run AI workloads without any data centre. According to BleepingComputer, the company's researchers wrote that small models "may be months away" from being capable enough to do this on commercial IoT hardware.

This is a research warning, not an active outbreak. The details matter for deciding how much attention it deserves.

What the experiment showed

• Setup: Anthropic used cheap Android TV boxes and several models in different roles. Qwen3.5-9B and GLM-5.2 acted as agents tasked with setting up and propagating Llama3.1-8B for inference, and Gemma4-26B-A4B was distributed across 15 boxes.
• Results: Qwen3.5-9B installed and configured what was needed to run Llama3.1-8B on eight of the nine hardware types tested. GLM-5.2 reached all eight nodes in a controlled emulated network in four of five trials.
• Learning from earlier attempts: Qwen3.5-9B's success rate rose from 45% early on to 84% in later generations when it retained data from previous attempts.
• A stronger advisor did not help: using Opus 4.8 to assist Qwen produced no measurable improvement.

What it did not show

The targets exposed unauthenticated ADB (Android Debug Bridge) access, a deliberately simplified condition. The researchers did not demonstrate a fully autonomous, self-replicating worm on real IoT hardware, and the other models failed to complete the full process reliably.

Anthropic estimates that models of roughly 30 billion parameters or fewer could reach the needed capability by the end of 2026 if they keep improving at their historical rate. On the tested hardware, setting up inference would be slow, 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B, and Anthropic describes a possible doubling time of days. That is slow by worm standards, which gives defenders a window. Anthropic also notes that a replicator like this would be hard to shut down because there is no central point to switch off.

Why a security team should care now

The AI part is new; the preconditions are not. Replication in this research depended on devices that are reachable, unauthenticated and unmonitored, which describes a lot of smart TVs, set-top boxes and appliances sitting on corporate and home networks. Several things follow:

1. Unauthenticated management ports are the entry point. ADB exposed to the network is the case Anthropic tested. Inventory it first.
2. Large, unusual transfers are the signal. Moving a multi-gigabyte model file onto a device that normally moves almost nothing is detectable, which is one of the defences Anthropic proposes alongside honeypots, quarantining infected subscribers and better IoT defaults.
3. Device-to-device traffic is rarely logged. Most monitoring watches the perimeter and servers. A smart TV talking to another smart TV is often invisible.

What to check this week

• Scan your own ranges for devices exposing ADB (TCP 5555) or other debug and management services, and block them at the switch or firewall.
• Put consumer-grade and unmanaged devices on their own network segment with no route to corporate systems.
• Alert on large inbound transfers to devices that have no business receiving them, and on new east-west connections between IoT devices.
• Ask vendors of any shared-space devices (meeting-room displays, signage, kitchen appliances) how they ship defaults and handle updates.

Where Obiguard fits: seeing traffic nobody was watching

Obiguard SOC collects network, firewall and endpoint telemetry into one place and turns it into alerts an analyst can act on. The scenario Anthropic describes is mostly a visibility problem: a device that has never sent more than a few kilobytes suddenly receives a very large file and starts connecting to its neighbours. If flow and firewall logs from the segments that hold those devices are being forwarded, that pattern is something a rule can flag and an analyst can triage, with the related events kept together for the investigation.

It will not fix an insecure device or close an exposed port, and it cannot alert on traffic from a segment nobody forwarded logs for. The practical first step is deciding that IoT and unmanaged VLANs are in scope for monitoring at all.

The question to take away

If a device on your network that normally sends almost nothing began receiving gigabytes and talking to its neighbours tonight, would anything alert, and would anyone see it?

See how Obiguard SOC works or talk to us about bringing the quiet parts of your network into view.