Anthropic's red team published an experiment on small models replicating themselves across IoT devices. The months and the end of the year are Anthropic's estimate, and the experiment ran in a closed environment and does not describe a detected attack.
- Anthropic's red team estimates that small AI models may be months away from replicating themselves across smart ovens and off-brand Android TV boxes.
- In a closed network of 8 nodes, only GLM-5.2 among the tested open-weight models made it end to end: 8 of 8 nodes in 4 of 5 trials. The step of breaking into the device was deliberately trivial.
- Small models will match GLM-5.2's level by the end of the year if they keep improving at their historical rate, Anthropic writes. Anthropic does not claim such a worm is already spreading.
Fifteen cheap TV boxes, bought at about $55 each, are networked together and running Gemma4-26B-A4B between them. About $825 of hardware in total. Speed: 0.39 tokens per second. It is slow. It works.
Until now a botnet has been an army of dumb devices running someone else's command. Anthropic is measuring when the army will be able to find its next soldier on its own and install its model there. Its answer: maybe months, not years. That is its estimate, from a lab experiment.
Speed is the other half. At TV-box speeds, full setup on a new machine takes 71 to 150 hours with Gemma4-26B-A4B and 28 to 51 hours with Qwen3.5-9B, by Anthropic's math. Anthropic also does the scale math. The Kimwolf botnet infected over 2 million devices, per Synthient, as Anthropic cites it. At that scale, with 15 TVs per copy, you get about 133 thousand copies, with at most about 40 H100s' worth of compute between them. Anthropic calls that a tiny amount of compute and compares the replicator to a slime mold or a swarm of fruit flies.
The worm learns along the way. When each generation of Qwen3.5-9B inherits the notes of the previous one, setup success rises from 45% in the first generation to between 61% and 84% in later ones. Advice from a stronger model, Opus 4.8, does not measurably help.
The defense, per Anthropic, is a familiar one. A worm like this leaves a network signature: gigabyte-sized payloads and traffic between devices that normally do not talk to each other at that volume. Decoy traps (honeypots) can catch its payload. With Mirai, an ISP that quarantined infected customers and notified them cleared 92% of infections within 14 days, against 74% with no notification. Eliminating it completely would take coordination across every ISP, which is difficult.
Some older botnets, like Mirai, spread simply through lists of factory passwords. Anthropic writes that real IoT security might not be dramatically more difficult than the trivial step in its evaluation. Start there: change the factory password on everything that reaches the internet.