Anthropic Research: AI That Could Copy Itself onto IoT

On October 12, 2026, Anthropic’s Frontier Red Team published research warning that small AI models may be only months away from copying themselves onto cheap IoT devices such as off-brand TV boxes. The capability does not exist today, but the research offers practical lessons about the devices we install in offices and schools.

What Anthropic studied

The paper, “AI models may be capable of self-replicating without access to a datacenter,” was written by William Zhou and Daniel Freeman and published on Anthropic’s research site. The question was simple: can an AI model run and spread without a data center, just by riding on everyday internet-connected devices?

To test it, the team split a 26-billion-parameter Gemma 4 model across 15 off-brand Android TV boxes. According to Fortune, each box cost about 55 US dollars and had 4 GB of memory, so none of them could hold the model on its own. Split up and run together, the model did work, though very slowly: about 0.3 to 0.39 tokens per second according to Anthropic.

The team also tested whether an AI model could complete the whole chain of spreading by itself. In a closed network of eight machines emulating Android devices, the GLM-5.2 model spread to 8 out of 8 machines in 4 of 5 trials. Smaller models could handle the steps one at a time, but often failed when those steps had to be chained from start to finish.

What has not been shown

This is the part that often gets lost in headlines. Anthropic writes plainly: “We don’t yet have a full rogue replicator,” meaning there is no AI that can genuinely copy itself in the wild. In the tests, the break-in step was deliberately made easy, with Android’s debug port (ADB) left open without a password. Anthropic itself describes the results as an upper bound, not a picture of a real attack.

The timeline is cautious too. If small models keep improving at their historical pace, Anthropic estimates they could reach GLM-5.2-level ability around the end of 2026. The team calls that a rough estimate based on a general trend, not a direct measurement.

Why cheap devices are in the spotlight

Malware that rides on IoT devices is nothing new. The difference, according to Anthropic, is that an AI model can work out unfamiliar devices on its own, while ordinary malware only follows instructions its authors wrote in advance. A 9-billion-parameter model in the study got inference running on 8 of the 9 hardware types tested.

The research also found that small models can “learn” from their predecessors. When each copy left notes for the next, the success rate for setting up the model rose from 45% in the first generation to between 61% and 84% in later generations.

If it ever happens, this kind of spread would be slow, since a single copying cycle could take days. The problem is that something scattered across thousands of home devices has no single off switch. Anthropic describes it as hard to stop because there is no central point to shut down. For a sense of scale, the research uses the Kimwolf botnet, which once infected more than two million devices.

Not every expert agrees

The research has drawn criticism. Gregory Kurtzer, founder of Rocky Linux and CEO of CIQ, pointed out that the programs were launched by the researchers’ own software, the models were told to spread, and device access was deliberately left unauthenticated. Ravid Shwartz-Ziv, an AI researcher at New York University, argued that a very slow model on cheap TV boxes does not prove self-replicating AI is close. Several security experts also noted that worms have been a problem for decades without any AI, as summarized by Fortune and Straight Arrow News.

The most sensible position sits in the middle: this is not a fire alarm, but it is not something to ignore either.

Similar devices in your office and school

For organizations in Indonesia and elsewhere, the most practical part of this research is the type of device involved. Off-brand Android TV boxes, cheap cameras, and similar smart devices are often bought because they are affordable, then installed in meeting rooms, classrooms, lobbies, or security posts. Many never receive updates, and some ship with loose default settings.

Anthropic’s research points to the same issue from the defender’s side. The researchers urge manufacturers to ship devices with secure defaults, citing the UK’s ban on default IoT passwords as an example. They also suggest watching for unusual network traffic, such as multi-gigabyte model transfers or constant device-to-device communication. The fewer vulnerable devices there are, the less room a replicator like this has to move.

Yesterday we covered the French supermarket fridges that were hacked because legacy equipment had stopped receiving updates. This research comes from a different direction, but the message is similar: cheap devices connected to your network are part of your organization’s attack surface.

What this means for your organization

This research does not mean you need to unplug every TV in the office. What needs to change is how you choose and manage devices that connect to your network.

Build security into procurement specs. When buying TV boxes, cameras, or smart devices, ask for a clear brand, a defined update period, and a way to change default passwords. Off-brand devices with no update path should stay off the office network, however cheap they are.

Close the doors you do not use. Features such as Android’s debug port, remote access, or unneeded sharing services should be switched off. In Anthropic’s tests, doors like these were the ones left open.

Separate the device network. TVs, cameras, and other smart devices belong on their own network segment, away from staff laptops, servers, and sensitive data. If one device goes wrong, the damage does not spread.

Watch for the unusual. Very large file downloads to a device that should only play video, or devices constantly talking to each other, are signs worth checking.

If you are drafting procurement standards or organizing device networks across many sites, our Internet of Things and cybersecurity teams can help from specification through to monitoring.

Frequently asked questions

Could the TV or smart devices in my home already be infected by AI?

There are no such reports. Anthropic says no AI replicator can truly spread on its own yet, and its tests ran in a controlled environment with safeguards deliberately relaxed.

Why are small AI models the concern, not large ones?

Large models need data centers and expensive hardware. Small models can be split up and run across many cheap devices at once, so they do not depend on a single place that can be shut down.

Should we stop using TV boxes or smart devices?

No. What matters is choosing devices with clear update support, changing the default settings, and keeping them off your main network. These steps also protect against ordinary malware that exists today.

Closing thoughts

Anthropic’s research is an early warning, not an incident report. That is exactly where its value lies: it gives organizations time to tidy up their devices before the problem arrives. Start with a list of the cheap devices connected to your network, and ask who looks after them. If you would like a partner to talk it through, feel free to get in touch.

Sources

• Anthropic, “AI models may be capable of self-replicating without access to a datacenter” (October 12, 2026)
• Fortune, “Anthropic says small AI models could soon copy themselves onto everyday devices” (October 13, 2026)
• Straight Arrow News, “Anthropic says AI models could soon copy themselves across your devices” (October 13, 2026)