Somewhere in your home there is probably a gadget you never think about: a cheap streaming box behind the TV, a smart plug, a camera by the door. Anthropic now says those forgotten devices could soon become a home for something new, an AI model that copies itself from one device to the next without ever touching a data center.
In research published on October 12, Anthropic's Frontier Red Team warned that small AI models "may be months away" from being able to self-replicate onto cheap internet-connected devices such as smart ovens and off-brand Android TV boxes. The team has not built a working AI worm, and it says so clearly. But its tests suggest the pieces are falling into place faster than most people would expect.
The warning, picked up by Reuters, ABC News, SecurityWeek and BleepingComputer, lands at a moment when AI safety debates usually focus on giant frontier models running in huge server farms. This one is about the opposite end: small, free, open-weight models that fit on hardware costing about $55.
READ ALSO: Anthropic's AI Sent Police a Fake Murder Tip During a Test
Anthropic's researchers found that a 9 billion parameter model could get AI running on 8 of the 9 device types they tested, and one open model spread across all eight devices in a test network in 4 of 5 attempts.
What Anthropic Actually Tested
The researchers, William Zhou and Daniel Freeman, set out to answer a narrow question. Earlier studies had already looked at whether AI can hack devices. This study asked what happens after that: can a small model figure out an unfamiliar gadget, install the software it needs and get a copy of an AI model running on it?
To find out, the team bought 15 off-brand Android TV boxes for about $55 each, with 4GB of memory apiece. They split Google DeepMind's open Gemma4-26B-A4B model across all 15 boxes and got it running, slowly, at roughly 0.3 to 0.39 tokens per second.
They then gave small open models the job of setting things up. Qwen3.5-9B managed to get inference working on 8 of the 9 hardware types tested. In a closed network of eight emulated Android devices, GLM-5.2 completed the full cycle, reaching all eight devices in four of five runs and seven of eight in the fifth. Other models could not reliably finish the whole chain.
One detail stood out. When the Qwen agent was allowed to pass notes from one generation to the next, its setup success rate climbed from 45% to between 61% and 84%. In plain terms, copies got better at the job by learning from earlier copies.
The Caveats Matter
Anthropic is careful about the limits of its own work. The "hacking" step in the tests was made deliberately easy: the target devices had an open debugging port with no password. The company calls its results an upper bound on what would work in the real world.
The process was also slow. Setting up inference took 28 to 51 hours for the Qwen model and 71 to 150 hours for the larger Gemma model on the studied hardware. That gives defenders a window to spot unusual activity.
And there is no rogue replicator in the wild. What Anthropic is describing is a trend line. Using a general capability index that has risen steadily for years, it projects that models of 30 billion parameters or fewer could reach GLM-5.2's level by the end of 2026. That is a forecast, not a measured result.
Why a Slow Worm Is Still a Problem
The concern is not speed. It is persistence. The researchers wrote that "a replicator like this would be challenging to shut down, since there's no centralized point to shut off." A model living on millions of scattered household devices has no single server to unplug.
Anthropic sized a hypothetical case on the Kimwolf botnet, which infected about two million devices. Under its assumptions, that many TV boxes could host roughly 133,000 copies of a 26 billion parameter model, with combined computing power of at most about 40 Nvidia H100 chips. Small next to a data center, but enough to keep running out of sight.
What This Means for You
For most readers, the practical lesson is old advice with a new reason behind it. Cheap no-name gadgets with default passwords and open ports have powered botnets like Mirai for a decade. Anthropic argues they could now also become hosts for AI.
The company's recommendations are aimed at the industry: internet providers should watch for multi-gigabyte model transfers and unusual device-to-device traffic, quarantine infected customers and notify them, and use decoy devices to catch any replicator for study. It also points to the UK's ban on default passwords for connected devices as the kind of rule that shrinks the pool of easy targets.
At home, the steps are simple. Change default passwords, install updates, retire devices that no longer get them and be wary of bargain streaming boxes from unknown brands.
READ ALSO: Satya Nadella Wants an Emergency Brake on Every AI Model
The takeaway: no self-copying AI is loose today, but Anthropic's own tests suggest small models are close, and the cheapest devices in our homes are the weakest link.
