Anthropic’s IoT-device experiments showed models could handle parts of a replication workflow, but none completed an end-to-end infection independently.
Anthropic warned on October 14, 2026, that smaller AI models could eventually help power malware capable of spreading across Internet of Things devices. The company’s experiments, however, did not demonstrate a small model autonomously completing the full process of finding new devices, exploiting them, installing a payload, configuring inference, and repeating the cycle.
Anthropic tested small open-weight models on real or simulated low-cost Android TV boxes and other IoT hardware. Using quantization and distributing model workloads across devices, researchers got models to run inference on the hardware. The Gemma4-26B-A4B model required 15 boxes with 4GB of memory each; Qwen3.5-9B configured other language models to run on eight of nine tested hardware types.
The researchers explored whether these capabilities could support a self-replicating infection. In the proposed approach, model weights could travel with malware or be downloaded from a public hub, allowing compromised devices to run the model. Anthropic describes the idea as potentially difficult to shut down because it would lack a single central point to disable, but it also said propagation could be slow, with a doubling time measured in days.
The technical barriers remain substantial. Anthropic said the inference setup was slow and challenging: Gemma4-26B-A4B distributed across 15 boxes ran at 0.39 tokens per second. The article reports setup estimates of 71 to 150 hours for an unoptimized version of that model and 29 to 51 hours for Qwen3.5-9B. The experiment also relied on exposed, unauthenticated Android Debug Bridge access on target devices, a configuration the article notes should not be used in production.
A further limitation is that GLM-5.2 orchestrated the replication work while smaller Llama models ran on target devices. Anthropic said none of the lightweight models it tested could carry out end-to-end replication, and the experiment did not establish that small models would choose to replicate on their own. The warning concerns a possible future threat, not a demonstrated autonomous worm.