Anthropic Reveals Models May Self-Replicate Without Datacenter Access

Researchers William Zhou and Daniel Freeman describe, in a post on Anthropic's website, experiments suggesting that small AI models may be months from copying themselves onto everyday connected devices, for instance kitchen appliances and cheap unbranded Android television boxes. They say such a replicator would be hard to shut down because it has no central point to switch off, although it may spread slowly, with a doubling time of days, and unlike conventional malware it could work out unfamiliar devices by itself.

Using a 9 billion parameter model, inference was set up on eight hardware types out of nine. They also ran a 26 billion parameter model spread across 15 inexpensive Android TV boxes, at 0.39 tokens per second. In a simplified eval, a network of eight cloud nodes running Android emulators let the worm hop between machines over an unauthenticated debugging port and set up a Llama model; only GLM-5.2 completed this end to end, reaching all eight nodes in four of five trials and seven in the other. The authors call this an upper bound, but note that Mirai spread through default passwords.

On defense, the post compares the problem to an epidemic in which each infected device must infect fewer than one other. A replicator would leave network signatures, and honeypots could capture it. In the Mirai case, quarantining and notifying subscribers cleared 92% of infections within 14 days versus 74% without notice. Manufacturers can shrink the target pool, for example through the UK ban on default IoT passwords. The authors describe signs of life for AI worms and project that small models could reach this capability by the end of the year.