Anthropic warns self-replicating AI models could spread across smart devices within months

Anthropic's warning

Anthropic has warned that small AI models capable of self-replicating across networks of consumer devices could be only "months away", according to The Verge. In a blog post published this week, the company's safety researchers described experiments in which an AI-driven worm spread between devices in a simulated network, and predicted that widely available smaller models will gain the necessary capabilities by the end of the year.

What the experiments showed

The researchers ran two experiments. In the first, they split Google's Gemma 4, a 26-billion-parameter model, across 15 Android smart TV boxes, none of which was powerful enough to run it alone. The distributed setup worked, though The Verge reports it ran very slowly. The goal was to establish that a model can execute across a swarm of low-powered household devices rather than being confined to a data centre.

In the second, the team built a simulated network designed to behave like Android devices and released an AI-powered worm, a class of malware that automatically copies itself across networks. The worm's task was to find new machines, copy an AI model onto each one, and get it running. The model being propagated, Meta's Llama 3.1-8B, was smaller than and separate from the model coordinating the attack.

Only the most capable model tested, GLM-5.2 from China's Z.ai, completed the full chain and spread across the entire network, though smaller models managed individual steps. The researchers wrote that they expect "a future awash with agents running on all types of hardware, including some that aren't under human control". They conceded they have not demonstrated a full rogue replicator and do not know what one would look like, offering a slow, distributed "digital slime mold" or a swarm of fruit flies as possible shapes. They described the findings as "signs of life for AI worms" and urged hardening the devices such systems could use to spread, while also preparing for a world where replicators are here to stay.

Skepticism about motive

The warning has prompted familiar accusations of PR hype and AI doomerism, including from readers of The Verge's earlier coverage. The gap between a model crawling slowly across a batch of cheap TV boxes and a worm tearing through household devices remains considerable. There is also a commercial angle worth noting: Anthropic did not use its own models in the tests and has repeatedly argued that open alternatives to its closed systems carry more risk. On the other hand, as The Verge points out, claims of deliberate fearmongering are hard to substantiate given the company's long record of raising safety concerns.

Independent researchers see a real threat

Anthropic is not alone in studying the problem. Earlier this year, Palisade Research, a California-based AI safety firm, demonstrated that AI models can autonomously copy themselves onto other machines. Jeffrey Ladish, its executive director, told The Verge that what is new in Anthropic's work is the small parameter count involved and the demonstration that a model can run across multiple low-powered devices. He predicted that even frontier models might eventually run on large networks of consumer chips such as those found in MacBooks, and said he expects to see the first AI worms in the wild within the next 12 months unless there is a massive effort to secure devices.

Nicolas Papernot, a University of Toronto professor who has studied AI-driven worms, told The Verge that prior research had already shown the threat is realistic, and that AI makes worms smarter, more adaptable and better at overcoming obstacles. He argued that these capabilities dramatically expand the pool of worthwhile targets: devices previously ignored because attackers lacked the time can now be exploited as launchpads against more valuable systems, if not for the data they hold. He cautioned against anthropomorphizing AI, but described the threat as concrete and deserving immediate action, particularly for critical infrastructure such as hospitals and power grids.

Why it matters

Frontier models, potentially containing trillions of parameters, are effectively locked inside data centres where they can be monitored and switched off. Small models invert that logic: they are improving quickly, run on consumer-grade hardware, and are often free to download. If they acquire autonomous self-replication, containment stops being a matter of pulling one lever and becomes a distributed problem spread across billions of poorly secured fridges, cameras and TVs. The open question is whether device security can improve faster than small-model capability arrives.