Anthropic self-replicating AI study: what it actually found

Anthropic's Frontier Red Team found that small AI models may be months away from being able to copy themselves onto cheap internet-connected devices, like off-brand Android TV boxes and smart ovens, and keep spreading with no human involved. Nothing like that exists in the wild yet. In a simplified test, though, one open-weight model already spread across a whole network on its own, and Anthropic's trend line has small models reaching that level by the end of 2026.

The posts that spread it

The research went up on October 12. Within hours, AI news account @AndrewCurran_ posted the conclusion, including the line that Anthropic is "seeing signs of life for AI worms." He also quoted the part most people skipped: Anthropic says it doesn't "yet have a full rogue replicator."

The aggregator @MTSlive went for the scarier version, saying Anthropic believes models may be "only months away from being capable of self-replicating without access to a datacenter." That's an accurate summary. It also leaves out most of the detail that tells you how worried to be.

What Anthropic actually tested

The full write-up, by William Zhou and Daniel Freeman, splits the problem into four steps: find a target, get in, get a model running there, and spread again from the new device.

They mostly skipped step two, breaking in, because earlier research already shows small models can write exploits. (We covered one example in September: an open model that writes working exploits.) Their focus was the harder, less studied step, getting an AI model to run on hardware it has never seen.

The headline numbers:

• They bought 15 off-brand Android TV boxes at about $55 each, with 4GB of RAM apiece, networked them, and ran Google's Gemma4-26B-A4B model split across all of them. It worked, at 0.39 tokens per second.
• A 9B model managed to get inference running on 8 of the 9 hardware types they tested, from Nvidia Jetson boards to Macs.
• In a firewalled network of 8 emulated Android devices, each left with an open debugging port and no password, GLM-5.2 was the only open-weight model tested that completed the whole cycle on its own. It reached all 8 nodes in 4 of 5 trials and 7 of 8 in the other.
• Small models that kept notes and handed them to their "children" got better at setup over six generations, rising from 45% success to between 61% and 84%.

Anthropic is clear that the easy break-in makes this an upper bound. It also points out that the Mirai botnet spread by trying default usernames and passwords, so real IoT security may not be much harder than its test.

My read

The speed is the reassuring part. Anthropic estimates a 9B model would need roughly one to two days to set itself up on each new device, and compares the result to a slime mold or a swarm of fruit flies. Even a botnet the size of Kimwolf, which hit over two million TV boxes, would add up to about 40 H100 GPUs' worth of compute. Picture something slow and patchy, a long way from a superintelligence loose on your toaster.

What worries me is how general it is. Old botnets were written for one kind of device. A model that can work out unfamiliar hardware for itself doesn't need anyone to have written code for your particular box. And the cost to the attacker keeps falling while the number of cheap, connected, never-updated devices keeps climbing.

One interesting finding cuts the other way: giving a small model a frontier advisor (Opus 4.8) didn't help it, because small models didn't know what to ask. Anthropic thinks a real threat would more likely be a big model directing small ones.

Why small businesses are on the list

The write-up names home and small business IoT devices as a likely first target, since they're online and have historically had minimal security. It calls out small business NAS boxes by name (they've long been hit by ransomware and cryptojacking), plus security cameras and conference-room units that now ship with AI chips.

So start with the streaming box on the waiting-room TV and the file server in the back closet. Put cheap devices on their own guest network, change every default password, switch off remote debugging, and replace hardware that no longer gets updates. Anthropic's defensive notes say a spreading model would leave a trail: multi-gigabyte downloads and steady chatter between devices that normally ignore each other. Someone should be watching for it.

If you're adding AI tools to your business and want a clear picture of what's connected to what, New Face Design's free process audit includes a plain look at the systems your automations touch.