Anthropic’s report issued on Monday (October 12) warns that in a few months, small AI models may self-replicate on consumer-grade Internet of Things (IoT) devices such as smart ovens, Android TV boxes, without the need for data centers or human assistance. These types of AI models lack a central shutdown point, making it difficult to completely shut them down.
The results of Anthropic’s Frontier Red Team experiments show that models with parameter scales below 30B (30 billion) can already complete many individual steps required for replication, and can run in a sharded manner on devices equipped with built-in small AI chips such as smart refrigerators, smart ovens, robot vacuums, lawnmowers, and security cameras. However, errors still occur when running end-to-end.
The research found that China’s Smart Spectrum AI model “GLM-5.2” and stronger models can already complete end-to-end replication in simplified tests. If these small AI models continue to progress at a rate of approximately 13.7 Epoch Capabilities Index (ECI) per year, it is expected that by the end of 2026, small models reaching GLM-5.2 replication levels will appear.
However, Anthropic emphasizes that ECI is only a proxy indicator, providing only a rough estimate and cannot provide an exact time frame.
To verify feasibility, the team purchased 15 non-branded Android TV boxes priced around $55 each with memory ranging from 1 to 4GB. Using pipeline parallelism to divide Google DeepMind’s Gemma4-26B-A4B model, each box holds only two layers of the model, successfully running at 0.39 tokens (AI output units) per second.
Anthropic mentions that these TV boxes mostly run Android open-source projects (AOSP) branched by the manufacturers themselves, without added security features. With 4GB memory and 4-bit quantization calculations, around 4 boxes can run a 9B (90 billion) AI model, and 10 boxes can run a 26B (260 billion) AI model.
Furthermore, these replicas do not require root access, as the inference engine can run entirely in user space, and even if the device is restarted, it may be reinfected.
In end-to-end testing, the experimental team set up an externally isolated virtual private cloud, containing 8 cloud nodes set up using the Android emulator redroid, where they inserted “patient zero” and allowed AI to pass through unverified ADB (Android Debug Bridge) ports to the next node, deliver payloads, and set up inference services (nodes host Llama3.1-8B, as a unified benchmark).
Results show that currently only GLM-5.2 among the tested open-source weight models can complete full end-to-end replication. In 5 trials, replication spread to all 8 nodes 4 times and to 7 nodes once, while other models failed. Anthropic points out that as ADB ports are unverified, this result should be seen as an upper limit on real-world success rates. Additionally, a 9B model succeeded on 8 out of 9 hardware types.
They found that other possible threat models include stealing API credentials to start hosts or paying inference fees through legitimate work such as digital freelance jobs.
The researchers warned in the report that while these AIs replicate and spread slowly, the biggest issue is their high adaptability. Taking Alibaba’s Qwen3.5-9B, for example, this AI shares prompts, code, and notes with the next generation, and after six generations, can increase the success rate of complete inference settings from 45% to a maximum of 84%.
The report also mentions that Gemma4-26B-A4B currently takes about 71 to 150 hours to complete a full inference setting on a TV box, while Qwen3.5-9B only needs 28 to 51 hours. According to the estimation of the zombie network peak reported by cybersecurity firm Synthient, with over 2 million infected devices, the network’s inference volume is equivalent to the computational power of 40 Nvidia H100 graphics cards.
Researchers refer to this phenomenon as a slow “digital slime”.
In terms of defense, Anthropic advocates for reducing the average number of devices each infected device re-infects (R₀) to below 1. Favorable conditions include large-scale replication leaving noticeable anomalies in Internet Service Provider (ISP) traffic monitoring; similar to the experience of Mirai, an ISP can isolate and notify infected customers, with 92% being cleared within 14 days, and only 74% of notifications being issued.
Manufacturers can also further reduce the target pool for AI attacks through more secure default settings and regulations.
Mirai, first seen in 2016, is malicious software that specifically targets and infects IoT devices (such as network cameras and routers) using weak passwords.
In conclusion, Anthropic warns that these phenomena indicate that “AI shows signs of life” and may be extensively present in various hardware and software, evolving from a slow, dispersed “digital slime” to powerful AI models that can rapidly surpass data center restrictions without human control. The global community should strengthen systems to inhibit the spread of such replicas and be prepared to face a world where AI already exists.