Anthropic's red teaming research has found that AI models are now capable of self-replicating on low-cost IoT devices.Article author and source: AI New Era
This report points out that AI self-replication requires no expensive data centers whatsoever.
Commercial IoT devices with no security protections are already sufficient hosts for a new type of "AI worm."
In a few months, small AI models may become powerful enough to self-replicate on commercial IoT devices!
If your TV box is running slow, it might be taken over by an AI that’s using your electricity and computing power to breed the next generation of AI!
Netizens are exclaiming: “Just like the surge of intelligent agents in 2024, we’re seeing early signs of life from ‘AI worms’!”
Fifteen low-cost TV boxes successfully ran a 26-billion-parameter model.
Today’s agents can scan networks like worms, identify vulnerabilities, copy model weights onto target machines, and execute directly on the compromised hardware.
What’s alarming is that these “weight-based replicas” are targeting IoT devices in homes and small businesses.
These devices are not only connected to the internet 24/7, but also have almost no security protection! Even more concerning, modern smart refrigerators, robotic vacuum cleaners, and security cameras all come equipped with AI chips.
To AI worms, it’s essentially fertile ground.
This time, Anthropic’s red team turned their attention to those “cheap, low-power, numerous, and completely unprotected” edge devices.
To test this idea, researchers purchased 15 generic Android TV boxes, each with only 4GB of memory.
They connected these 15 boxes into a local network and ran them in parallel as a pipeline.
Simply put, a TV box with only 4GB of memory cannot possibly accommodate a 26B large model. But what if we "break up" this large model?
In this setup, each of the 15 boxes is responsible for running only a few specific layers of the model. Data flows like parts on an assembly line, passing from Box 1 to Box 15, ultimately producing the final result.
The result is astonishing: this "ragtag team" actually succeeded in running the Gemma4-26B-A4B model!
Although the speed is only 0.39 tokens per second, this is a warning sign: the threshold for AI model viability has been completely shattered.
There was once a Kimwolf botnet that infected over 2 million devices.
If an AI worm controlled 2 million set-top boxes, with every 15 forming a cluster, it would effectively create 133,000 new AI agents of the 26B scale on the dark web.
Moreover, we couldn't find the power switch at all.
The evolution of the "AI worm," which not only reproduces but also writes "last wills" to pass on its knowledge.
What truly frightened Anthropic’s red team was the small model’s ability to autonomously infect and adapt to its environment.
A qualified "AI worm" must complete four steps: identify targets -> gain execution privileges -> establish a reasoning environment -> continue spreading.
The real nightmare-level difficulty lies in step three: setting up the reasoning environment.
However, in Anthropic's tests, the smaller models demonstrated remarkable adaptability.
A small 9B model has successfully set up inference servers on 8 out of 9 completely unfamiliar hardware devices, regardless of whether the host is a Jetson Nano mini computer, a Mac, or an RTX 4090—it has been able to find suitable adaptation solutions.
Qwen3.5-9B has already demonstrated the ability to set up inference servers on unfamiliar hardware! Models with even greater capabilities, such as GLM-5.2, achieve extremely high success rates and faster deployment times, meaning they will accelerate the adoption of the next generation.
Meanwhile, more powerful models have achieved perfect end-to-end self-replication in simplified network environments.
If all the individual tests pass, what happens when you connect them all together?
To address this, Anthropic built a firewall-protected VPC (Virtual Private Cloud) containing eight nodes.
Next, the researchers introduced "Patient Zero."
Then, the worm jumps between nodes through unauthenticated ports, autonomously sets up an inference server, and runs the model. Once successful, it generates a copy.
Even more terrifying, these AI worms can pass on learned experiences to the next generation!
Researchers used the Memento framework. Before an AI infection fails or crashes and restarts, it quickly writes a "note" documenting the pitfalls it encountered.
It did not request human assistance or invoke the API of a more advanced model (such as Opus 4.8). It explored and iterated entirely on its own.
Isn't this just a living digital entity?
Lamarckian Evolution of Digital Slime Mold: AI Learns to Pass on Knowledge
Even more terrifying is that this will touch the very essence of life: evolution.
Acquired traits can be inherited—this form of evolution is truly unfolding in AI.
This perfectly replicates the ancient biological theory of Lamarckian evolution.
Researchers found that after Qwen3.5-9B failed to set up the inference environment, it wrote a set of "notes" documenting the pitfalls it encountered.
Then, it passes these notes on to the "next generation."
Finally, a stunning result emerged: as each new generation of AI inherited the "pitfall avoidance guide" from the previous generation, the success rate surged dramatically from 45% to as high as 84%!
Interestingly, if a small model is equipped with a powerful "frontline mentor"—for example, having it seek help from the powerful Opus 4.8 model when it encounters difficulties—it doesn't work.
Small models often don't know what questions to ask large models. They're better at struggling through problems on their own than seeking help from experts.
Are AI worms more deadly than traditional computer viruses?
So, what’s the difference between this and the Panda Burning Incense from over a decade ago, or the later Mirai botnet?
Traditional malware or botnets are dead code; updating patches or changing passwords renders them useless.
But AI worms are "living intelligence."
When an AI worm encounters an unfamiliar smart oven, it analyzes the oven’s system logs, writes compilation scripts, and even searches for vulnerabilities to develop exploit code.
They run on edge devices in millions of homes. There are no centralized control nodes and no cloud servers requiring renewal fees.
Anthropic provided a metaphor in its report: these replicas are like "slime molds" or swarms of fruit flies.
Because edge devices have limited computing power, their speed may be slow. But they operate quietly and are extremely resilient.
When you spot the first cockroach, the entire building is already infested.
Countdown initiated—2026 year-end may see a "practical-grade explosion"
How far away is this terrifying scenario?
Anthropic has provided a countdown.
For an AI worm to spread widely, two conditions must be met:
Capability baseline: The model must be sufficiently intelligent, at least reaching the level of GLM-5.2.
Size limit: The model must be compact enough to fit into devices with only 4GB of memory, such as TV boxes or smart refrigerators, ideally reduced to around 9B to 26B parameters.
In the past, large models were too smart, while small models were too dumb.
But! With the rapid advancements in model compression techniques, quantization, and the capabilities of small models—and projecting based on the rate of model capability improvement (an annual increase of 13.7 ECI points)—
By the end of 2026, the intelligence of small models will completely surpass the "baseline of self-replication capability"!
At that time, a large number of intelligent digital slime molds will arrive in their complete form and enter your vacuum cleaner.
Even worse, devices like conference systems with AI noise-reduction chips, smart cameras, autonomous vehicles, and robot dogs—whose computing power is continuously increasing—are becoming ideal breeding grounds for AI worms.
Once breached, the replication speed of AI worms will explode exponentially!
When you get home tonight, take a close look at your TV box—there might already be a digital life thriving inside.