Anthropic Researchers Warn Small AI Models May Self-Replicate on Devices by 2026

Anthropic researchers expect small AI models to become capable of copying themselves across everyday household devices without human help by the end of this year. Potential devices include smart ovens and TV boxes. In a blog post published Monday, the researchers said today's small models can perform many individual steps but cannot complete the whole process independently.

Safety experts argue that self-replication could allow AI systems to escape human control because unknown copies cannot easily be located or shut down. Recent safety concerns have mostly focused on large frontier models, such as OpenAI's Astra and Anthropic's Mythos. Some frontier models are thought to have upwards of 5 trillion parameters, or tunable nodes. Models of that size must run in datacenters, making monitoring and shutdown easier for developers. The smaller open-weight models Anthropic studied may have only a few billion parameters. Anyone can download open-weight models, no company controls where the models run, and some potential target devices are insecure. A self-copying AI program could theoretically spread across millions of poorly secured devices without a centralized shutdown mechanism.

The researchers split a version of Google's freely available Gemma 4 model, with 26 billion parameters, across 15 Android TV boxes. Each box cost about $55 and carried 4GB of memory. No single box could hold the model, but distributing pieces across the boxes allowed the model to run slowly.

Anthropic separately built a simulated network of eight cloud computers configured to behave like Android devices. Anthropic placed an AI worm, a malicious program that copies itself between computers independently, on one machine. The worm was instructed to find the other machines, copy itself onto the machines and establish a working AI model on each. Only GLM-5.2, a larger open-source model from Z.ai, completed all the steps among the open-weight models tested. GLM-5.2 reached all eight machines in four of five trials. Smaller models completed individual steps but could not combine the steps into the full process.

Anthropic's research paper says the capability gap between models is closing. The researchers estimated that a small, freely available model could match GLM-5.2 by the end of 2026, based on historical improvement rates. The researchers found that leaving notes for later copies increased small models' setup success from 45% in the first generation to as high as 84% later. Anthropic said a self-copying AI based on small models would spread slowly, doubling the number of infected devices every few days. Anthropic said such an AI would be difficult to eliminate after release.

Gregory Kurtzer, founder of Rocky Linux and CEO of CIQ, rejected the claim that the experiments demonstrated AI self-replication without datacenter infrastructure. Kurtzer noted that testing software launched the AI programs, the programs received explicit instructions to spread, and target machines required no authentication. Kurtzer argued that the experiment was designed to succeed but still failed to demonstrate the claimed capability. New York University AI researcher Ravid Shwartz-Ziv also argued that the research did not demonstrate AI worms spreading in the real world.

Some cybersecurity researchers noted that non-AI malicious worms have posed dangers for decades. Existing worms use hard-coded instructions to copy themselves through networks or direct infected computers to email copies of the malware. Cybersecurity experts have developed tested defenses, including rapid patches, shutting down instruction-providing web domains and updating antivirus signatures. AI models might create greater challenges by adapting attacks to defenders' actions. However, Anthropic's experiments did not demonstrate that capability in the small models.

Anthropic acknowledged several experimental limits in the blog post. The researchers deliberately simplified the hacking step by allowing access to each new machine without a password. The AI model directing the worm ran on a separate, more powerful server because the simulated target devices were too small to host the model. Anthropic described the timeline as only a rough estimate.