Even as there have been several hacks of systems around the world caused by autonomous AI systems, it turns out that these systems might not even need massive central datacenters to run and operate.
Anthropic researchers have warned that artificial intelligence models could soon be capable of replicating themselves across everyday internet-connected devices, including smart ovens, televisions and other low-cost gadgets, without relying on expensive datacenters. In a research post, Anthropic’s Frontier Red Team said its experiments suggest that smaller AI models may be only months away from becoming capable of autonomously spreading across vulnerable Internet of Things (IoT) devices. Such a network could allow AI software to survive across thousands of machines without a central server that defenders could simply switch off.
The research does not claim that an uncontrollable, self-replicating AI has already escaped into the wild. Instead, it demonstrates that several of the technical capabilities needed to build one are beginning to come together. The immediate concern, it appears, is not an AI becoming conscious or independently deciding to reproduce, but malicious software powered by an AI model that can find vulnerable machines, establish itself on them and continue spreading.
How Could An AI Run On A Smart Oven Or TV?
Running a modern AI model typically requires powerful processors and substantial memory, resources usually associated with datacenters. But Anthropic argues that a sufficiently large collection of inexpensive devices can provide an alternative.
In one experiment, the researchers ran Google’s Gemma 4 model, with 26 billion parameters, across 15 inexpensive Android TV boxes costing approximately $55 each. The system generated around 0.39 tokens per second.
That is extremely slow compared with a modern AI server. However, the demonstration establishes that a distributed collection of inexpensive consumer devices can collectively run a model that would be difficult to accommodate on a single device of this class.
The trick is to divide the model into smaller pieces. Each TV box stores and processes a portion of the model, passing information to the next machine as the AI generates a response. The devices effectively work together as a makeshift AI computer.
Similar possibilities exist with smart refrigerators, ovens, robot vacuums, security cameras and other connected appliances. Devices equipped with small AI chips could offer additional computing capacity.
The more unsettling possibility is that an AI-powered computer worm could exploit vulnerable devices and use their combined resources to run copies of an AI model.
How Would Self-Replication Work?
Anthropic breaks the process into four stages.
First, the AI agent would look for potential targets on a network. Second, it would need to gain access to a vulnerable device. Third, it would configure the machine to run an AI model, dealing with the differences in hardware, operating systems and software libraries. Finally, it would use the compromised device to continue the replication process.
The first two stages involve cybersecurity vulnerabilities, a problem that predates modern AI. The newer concern is that AI agents could increasingly automate the complicated work required to get themselves running on unfamiliar machines.
A conventional computer worm generally relies on predefined instructions and known vulnerabilities. An AI-powered worm could potentially adapt its approach when it encounters a different device, troubleshooting software errors and working out how to run inference on hardware it has not encountered before.
Anthropic tested this capability using a controlled network of eight simulated Android devices. Among the open-weight models tested, GLM-5.2 was able to complete the simplified replication process reliably, reaching all eight nodes in four out of five trials.
However, the experiment deliberately simplified the initial compromise: the simulated devices had an Android Debug Bridge port open without authentication. This means the results do not demonstrate that the model could reliably break into normally secured devices on the public internet.
The researchers also found that a smaller model, Qwen3.5-9B, improved its success rate at configuring unfamiliar hardware when successive agent instances inherited notes about earlier attempts. In other words, later copies could benefit from the experience of their predecessors.
Anthropic estimates that if smaller models continue improving at their historical rate, models with the necessary combination of capability and efficiency could emerge by the end of 2026. This is a projection, not a confirmed deadline.
The Biggest Risk: An AI Network Without A Kill Switch
The most significant implication is that a distributed AI worm could be difficult to eliminate once it spreads widely enough.
Traditional AI services depend on identifiable infrastructure. Shut down the servers or revoke access to the API, and the service stops functioning. Ilya Sutskever has already warned that compromised neo-clouds could be a security threat. But a self-replicating network operating across compromised consumer devices would be different: there might be no single server to disable.
Anthropic estimates that a model running across low-cost devices could take more than a day to replicate in some configurations. Its spread would be slow, but persistent. Even if individual devices offer little computing power, thousands of them could collectively sustain a network of AI agents.
The company also warns that such a network could adapt as it spreads, carrying forward code, prompts and notes about what worked on previous machines. This could make the malware more effective at handling unfamiliar environments over time, although the researchers have not demonstrated that an AI worm can reliably evade defenders.
Why The Threat Is Not Yet Imminent
There are important limitations to the research. Running a model on inexpensive hardware is not the same as autonomously compromising devices across the internet. The researchers’ end-to-end replication experiment used deliberately weakened security, and the demonstrated system was slow.
Anthropic also acknowledges that the models it tested do not yet reliably combine every required capability in realistic conditions. Its estimated timeline for smaller models to reach the necessary level is based on historical improvements in a general capability benchmark, not a guarantee that self-replication will become possible on a particular date.
Nevertheless, the direction of progress is crucial. As models become better at coding, debugging and operating computer systems, they may need less human assistance to perform complicated sequences of actions.
What Can Be Done About It?
Anthropic recommends strengthening the security of connected devices, particularly by eliminating default passwords, improving authentication and making software updates easier to deploy.
Network operators could also look for unusual traffic patterns, such as devices transferring large AI-model files or communicating continuously with machines they would not ordinarily contact. Quarantining compromised devices could help contain an outbreak before it spreads further.
For manufacturers, the findings offer another reason to treat cybersecurity as a core requirement rather than an optional feature of inexpensive smart appliances.
Anthropic’s warning ultimately points to a shift in the nature of AI risk. The danger may not require a giant model running inside a giant datacenter. It could emerge from relatively small models operating on ordinary hardware, connected by networks and capable of working through problems with limited human intervention.
The researchers describe the current findings as early signs of a possible threat, rather than evidence of a fully autonomous AI worm in the wild. But if the capabilities converge as predicted, the security perimeter for AI may eventually extend far beyond datacenters — into the TVs, cameras and appliances connected to the internet in homes and businesses.