AI models may soon replicate across smart devices without human control, Anthropic says

Small artificial intelligence models could soon become capable of copying themselves across internet-connected devices without human control or access to data centers, according to new Anthropic research.

The study, published Sunday by the US AI company’s Frontier Red Team, examined whether AI models could independently find devices, transfer model files, establish the software needed to operate and continue spreading from each newly infected machine.

Researchers said models with fewer than 30 billion parameters can already complete many individual stages of that process, although most still struggle to combine them reliably.

In a controlled and simplified experiment, the GLM-5.2 model successfully spread across all eight available test devices in four of five trials and reached seven in the remaining trial.

Anthropic stressed that the experiment simplified the hacking stage by using devices with an unsecured connection. The results therefore do not demonstrate that an AI model can currently escape and reproduce autonomously under real-world conditions.

“We don’t yet have a full rogue replicator,” the researchers said. However, they warned that agents were becoming increasingly capable of completing the necessary steps and passing useful information to later copies of themselves.

The study focused particularly on inexpensive internet-of-things devices, which frequently have limited security protections. Potential targets could include smart televisions, refrigerators, ovens, vacuum cleaners, security cameras and videoconferencing equipment.

Anthropic demonstrated that a 26-billion-parameter model could run across 15 inexpensive Android television boxes costing about $55 each. A smaller model successfully established the software required to operate on eight of the nine types of hardware tested.

Unlike conventional computer worms, a self-replicating AI system could potentially adjust to unfamiliar devices, diagnose technical problems and pass successful strategies to future copies.

The researchers said such a system would initially spread slowly, possibly taking one or two days to produce each new copy. However, it could be difficult to eliminate because there would be no central server to switch off.

Anthropic estimated that, if smaller models continue improving at their historical pace, they could reach the capability demonstrated by GLM-5.2 by the end of 2026. The company cautioned that this was only a rough projection based on general capability trends.

The researchers recommended monitoring unusual network traffic, isolating infected devices and requiring manufacturers to strengthen default security settings.

They warned that early, slow-moving replicators could signal the future arrival of faster systems capable of breaching more secure computers.

“We should aim to harden our systems to make it difficult for such replicators to spread,” they said, “but also prepare to deal with a world where they are here to stay.”