Anthropic warns small AI models could self-replicate through IoT devices

Anthropic is warning that advances in small AI models could enable a new class of malware it calls small weight-based replicators: agents that carry model weights onto compromised IoT devices, run inference locally, and try to spread. Ars Technica reports the company tested quantized open-weight models on low-cost Android TV boxes and similar hardware, and found they could establish inference by sharding workloads across machines with as little as 4GB of memory each.

The company is clear that no lightweight model it tested completed end-to-end replication on its own. Setup was slow—tens of hours in some configurations—and the experiment relied on exposed debug interfaces and larger models to orchestrate parts of the process. Still, Anthropic says 30B-parameter models already handle many individual replication steps, and that if small models keep improving at their current pace, limited results could arrive by year-end, with weight-based replicators possible soon after.

That matters because IoT worms already exist. What changes is adaptability: a model that can reconfigure itself for unfamiliar devices, leave notes for future copies, and re-download weights from a public hub is harder to fingerprint and shut down than Mirai-style code.

We’re watching this story for what it is, not what the headline wants it to be. Anthropic did not say AI worms are loose on the internet. It said the building blocks are getting cheap enough, and capable enough, that defenders should stop treating the idea as science fiction.

The useful part of the research is the middle of the chain: getting inference running on junk hardware. Traditional IoT malware needs someone to write a payload for a specific chip and OS. Anthropic’s framing is that a small model can, in principle, pick inference software, install dependencies, and debug platform quirks as it goes. That is a different threat model. There is no single C2 to unplug if the weights travel with the infection or get pulled again from Hugging Face.

We also need the caveats in the room. The test devices had an unauthenticated Android Debug Bridge exposed—something that should never be on a production device. Orchestration leaned on a larger model. Throughput was miserable. Independent researcher Xiaohan Fu told Ars the study does not establish that small models would choose to replicate on their own. Capability is not the same as autonomous intent, and labs should publish prompts and agent setups so outsiders can tell the difference.

Even so, the direction of travel is clear. Open weights, quantization, and agent tool use are making serious computation possible on devices nobody thought of as AI hosts. Manufacturers who leave debug ports open, or ship firmware that never gets patched, are building the substrate. We’re not calling for a ban on small models. We are saying security teams should treat “model weights as payload” as a live planning assumption, and that IoT vendors need to close the easy doors before the hard ones get tested in the wild.

Computer worms that spread across poorly secured IoT devices are an old problem. What Anthropic is modeling is whether agentic small models could make those infections more adaptive—configuring themselves for unfamiliar hardware and carrying their own inference stack as they move.