Anthropic warns small AI models could self-replicate through IoT devices
The important shift here is not simply that smaller models might be abused for malware, but that they could reduce one of defenders’ long-standing advantages: attackers traditionally have to tailor payloads to specific device classes, firmware variants, and resource constraints. If a compact model can adapt deployment steps at runtime across heterogeneous IoT endpoints, defenders face a more fluid threat model in which low-cost, poorly managed devices become both targets and execution substrate.
For IT and security teams, the practical concern is less “AI on a fridge” than unmanaged edge inventory. Consumer-grade Android boxes, embedded Linux devices, and operational appliances often sit outside normal endpoint controls, patch cadences, and telemetry pipelines. In that environment, sharded execution matters architecturally: a malicious capability distributed across multiple devices may not present as a single obvious compromise, making containment, forensics, and eradication slower.
This raises several implementation questions organizations should address now:
- Can every IoT and edge device be identified, classified, and tied to an owner?
- Are east-west network paths between smart devices tightly segmented, or can devices discover and coordinate with one another?
- Do monitoring tools capture anomalous lateral traffic, unexpected model downloads, or unusual memory and storage patterns on embedded platforms?
- Are procurement standards excluding unsupported, off-brand, or opaque devices that cannot be patched or centrally managed?
The near-term defense priority is therefore basic but often neglected: treat IoT as part of enterprise attack-surface management, not as disposable infrastructure. Segmentation, firmware governance, software bill-of-materials visibility, and egress controls may do more to blunt this class of threat than model-specific countermeasures alone.
AI company Anthropic is warning that advances in small AI models could soon usher in a new era of self-replicating malware that’s capable of infecting smart fridges, vacuum cleaners, and a wide range of other Internet of Things devices and is more resistant to takedown.
By next year, smaller AI models may be able to autonomously self-replicate on all kinds of IoT devices, the company said. Eventually, the capability could enable computer worms, which propagate without requiring human interaction and are capable of infecting unfamiliar IoT devices. An experiment the company performed recently revealed significant challenges in bringing such an AI malware replicator to fruition, so the finding is necessarily tempered. Still, the results raise concerns about the possibility of new forms of computer worms.
Challenging to shut down
Anthropic further warned not only about the new potential malware, but also that it could be difficult to stop. In its blog post, it wrote that “a replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own.”
Smaller AI models require much less powerful hardware to run than do frontier models. Anthropic ran small open-weight models on real or simulated low-cost, off-brand Android TV boxes and other types of IoT hardware. Company researchers found that by using quantization to represent the models using fewer bits and splitting the workloads into “shards” running on each device, the models were able to establish inference, meaning that the model weights loaded and could generate output.
The lightweight Gemma4-26B-A4B model required just 15 boxes, each equipped with only 4GB of memory, to achieve inference. The Qwen3.5-9B was able to configure other LLMs to run on eight of nine hardware types. Unlike traditional malware, which must be written to run on specific hardware or software, the model was able to use its weights to make configurations on the fly that were specific to the devices it was tested against.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.