Small artificial-intelligence models may be only months away from gaining enough capability to copy themselves across vulnerable smart devices, according to new research from Anthropic that raises a fresh cybersecurity concern for homes and businesses.
The company’s Frontier Red Team tested whether AI agents could reproduce without relying on a conventional data centre. Its researchers found that models with 30 billion parameters or fewer can already complete many of the separate tasks required for replication, although current systems still make too many mistakes when asked to manage the entire process reliably.
In simplified experiments, where some security obstacles were removed, Anthropic said GLM-5.2 and stronger models completed an end-to-end replication sequence. The researchers projected that smaller models could reach a comparable capability by the end of 2026 if improvement continues at its recent pace.
The warning does not mean that an autonomous AI worm is currently spreading through household appliances. Anthropic said it has not demonstrated a fully reliable rogue replicator in the real world, nor autonomous replication through commercial data centres. The research instead identifies a developing capability that defenders may need to address before it becomes practical for attackers.
How an AI replicator could spread
Traditional botnets are networks of compromised computers, routers, cameras and other connected devices controlled by an attacker. They can be used to distribute spam, steal information or overwhelm a target with bogus traffic.
Anthropic’s proposed AI version would add the ability to adapt. Rather than depending entirely on pre-written instructions for each device, an AI agent could analyse unfamiliar hardware, work out how to run a small model on it and preserve useful instructions for the next stage of the attack.
The company reported that a nine-billion-parameter model succeeded in getting inference running on eight of nine hardware types it tested. The experiments suggest that inexpensive internet-connected equipment, including off-brand Android television boxes and smart appliances, could collectively provide enough computing power for a slow, distributed AI network.
Such a system would not necessarily spread at the speed associated with familiar computer worms. Anthropic estimated that parts of the process could take days. However, persistence could matter more than speed. A distributed network with no single server would be difficult to eliminate by switching off one central system.
The researchers compared that possibility to a form of digital slime mould, spreading gradually across low-powered equipment. A compromised device would need to infect enough additional devices for the network to continue growing.
Important limits to the experiment
The distinction between demonstrated capability and projected danger is essential. Anthropic removed some security steps in its simplified evaluation, and present-day models struggled to combine all the necessary actions consistently under more realistic conditions.
The study therefore does not show that artificial intelligence has spontaneously developed a desire to reproduce. A malicious operator, unsafe deployment or badly designed autonomous objective would still be central to the risk.
It also does not establish a precise date when such attacks will become practical. The end-of-2026 estimate depends on small models continuing to improve at their historical rate, which may not happen evenly.
Even so, the research matters because smart devices often remain connected for years, receive inconsistent software support and may be protected by weak credentials. A small improvement in autonomous problem-solving could make it easier for attackers to exploit that uneven security at scale.
What households and businesses can do
Consumers do not need to panic or disconnect every smart product. The immediate response is to reduce the ordinary weaknesses that any automated attack, whether driven by AI or conventional malware, would seek to exploit.
Britain’s National Cyber Security Centre advises users to replace default passwords, choose strong and unique credentials, enable two-step verification where it is offered and install software updates promptly. Automatic updates should be switched on when available.
Remote access should be disabled when it is not needed. Buyers should also check how long a manufacturer promises to provide security updates. Devices that have reached the end of support may remain functional while becoming progressively less safe.
Businesses face a wider task. They should maintain an inventory of connected equipment, restrict unnecessary internet exposure and separate lower-trust devices from sensitive systems where possible. Security teams should watch for unusual network traffic and remove unsupported equipment rather than allowing forgotten cameras, displays or appliances to remain permanently online.
Manufacturers carry a significant share of the responsibility. Guidance from the US National Institute of Standards and Technology calls for security to be considered before products reach the market and throughout their maintenance and end-of-life periods. Devices should be designed so that owners can identify them, control access, protect stored data and receive secure updates.
Why the warning matters
AI-related cyber risk is often discussed in terms of large models attacking major institutions. Anthropic’s work points to a different possibility: small models distributed across millions of ordinary devices, each contributing limited computing power to a persistent network.
The gap between laboratory evidence and a working real-world threat remains substantial. That provides an opportunity for manufacturers, regulators and network operators to harden systems before attackers can reliably automate the full chain.
The practical lesson is not that every smart television or oven is about to become an AI agent. It is that weakly secured connected devices already provide fertile ground for botnets, and improving AI could make those networks more adaptive and harder to remove.
Follow Podium News for clear, verified coverage of artificial intelligence, cybersecurity and the technologies affecting everyday life.
