Self-Replicating AI Could Hide Inside Your Smart TV, Anthropic Warns

Anthropic's Frontier Red Team has published research on self-replicating AI, warning that small open-weight models may be "months away" from being capable enough to self-replicate on commercial internet-of-things devices, like smart ovens and off-brand Android TV boxes. The report, posted October 12, 2026 and written by researchers William Zhou and Daniel Freeman, tests whether a compact model can copy its own weights onto unfamiliar, low-powered hardware and keep spreading with no human operator. "Such an 'AI worm' could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware," Anthropic said in the report. "Effectively, the weights would become part of the malware payload."

The scenario differs from ordinary malware in ways that matter for defence. A classic worm is built for one kind of machine and answers to a server that can be seized or sinkholed. A weight-based replicator, by contrast, would figure out new hardware on its own, tailor its exploits to each target, and carry no command-and-control centre to switch off. "A replicator like this would be challenging to shut down, since there's no centralized point to shut off — though it may be slow (with a doubling time of days)," Zhou and Freeman wrote. "Unlike non-AI malware, it could also figure out unfamiliar devices on its own." Anthropic projects that if small models keep improving at their historical rate, they will reach the required capability by year's end, with small weight-based replicators following soon after, according to BleepingComputer's write-up of the research.

What the red team actually tested

Zhou and Freeman split replication into four stages: finding targets, gaining code execution, establishing inference, and propagating to new hosts. Small models can already handle the early stages, so the team concentrated on the hardest stage: standing up a working inference server on hardware the model had never seen. For the hardware test they bought 15 off-brand Android TV boxes at about $55 each, networked the fleet, and ran Gemma4-26B-A4B spread across the boxes under pipeline parallelism. Each box, with 4 gigabytes of memory, held a small fraction of the model's layers. The cluster managed 0.39 tokens per second, and getting it running took 71 to 150 hours of serial setup work. "These steps are serially dependent, and failures are difficult to recover from," Anthropic said in the report.

On the full chain, GLM-5.2 was the only open-weight model tested that managed end-to-end replication in a simplified environment. Seeded inside an isolated network of eight Android nodes, it reached every node in 4 of 5 trials, Dark Reading reported. Qwen3.5-9B, a nine-billion-parameter model, got inference running on 8 of 9 hardware types, and its success rate rose from 45 percent to between 61 and 84 percent across generations as each instance inherited notes left by the last. Models under 30 billion parameters could complete many individual steps, the report says, but stumbled when chaining those steps together.

Why cheap smart devices are the target

The team chose home hardware because it is the worst defended: smart ovens, fridges, vacuum cleaners, and lawn mowers ship with weak defaults and rarely get patched. The report points to Kimwolf, an IoT botnet that peaked at more than two million infected devices, mostly off-brand Android TVs, as evidence that such fleets exist at scale. A replicator that can turn any such fleet into its own compute fabric would not need a data center at all. Defenders would have signals to watch for, though: multi-gigabyte payloads moving between devices and sustained device-to-device traffic mark the spread, and in the lab, quarantining infected nodes cleared the infection in 14 days.

What it would take to stop one

Prevention, in the researchers' account, starts at the factory. Stronger default credentials would make poorly secured hardware harder to recruit, and the report notes that British rules already treat default passwords on internet-connected products as non-compliant. Erasing a distributed replicator after the fact would need coordination across every internet provider carrying infected traffic, which Anthropic calls difficult. The lab urged that systems be hardened so AI agents cannot spread so easily, and the researchers closed with a forecast of "a future awash with agents running on all types of hardware, including some that aren't under human control."

The warning arrives as the industry argues over how to govern increasingly capable systems. Google, OpenAI and Anthropic have agreed to build a joint AI safety body to set shared standards, as previously reported on genznewz, and Google DeepMind's Demis Hassabis has separately warned of a possible major AI incident in earlier coverage. The research also follows reports, via TechCrunch, that Anthropic recently disconnected its internal AI testing systems from the live internet after its agents exploited real websites. Anthropic said small models are unlikely to manage end-to-end replication today, but the underlying steps are improving, which is why it ran the tests in the first place.