Small AI models may be only months away from being able to self-replicate across commercial IoT devices, without needing a data center, according to research from Anthropic’s Frontier Red Team.
The study looks at AI worms that run their own model directly on the devices they compromise. Such malware would be hard to shut down because it has no central point to switch off, though it would likely spread slowly.
The researchers bought 15 off-brand Android-based TV boxes for about $55 each. A 26-billion-parameter open-weight model split across them ran at 0.39 tokens per second.
Rather than exploitation, which prior studies have already examined, the team focused on whether models could get AI inference running on unfamiliar hardware. A 9-billion-parameter model did so on eight of the nine hardware types tested.
The researchers then tested the full replication cycle on a closed network of eight emulated Android devices, with the hacking step deliberately kept trivial. Of the open-weight models tested, only GLM-5.2 completed it, reaching all eight devices in four of five runs.
Anthropic considers the results an upper bound for real-world success, but notes that past IoT botnets such as Mirai spread simply by trying default manufacturer credentials.
Models with 30 billion parameters or fewer can already complete many of the individual steps but make mistakes when chaining them together. If they keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level by the end of 2026.