Anthropic warned that small artificial intelligence models could be within months of gaining the ability to self-propagate across commercial Internet of Things devices, such as low-cost Android TV boxes and smart ovens. This scenario could lead to the creation of distributed networks of devices capable of running AI workloads without relying directly on data centers.
However, the warning is not based on an imminent attack or on a complete demonstration of an autonomous AI worm. Researchers successfully distributed Google DeepMind’s Gemma4-26B-A4B model across 15 unbranded Android TV boxes, but they did not succeed in demonstrating a complete cycle that begins by finding and compromising devices and then automatically copying itself across real IoT hardware.
What Did the Experiment Show?
Anthropic used inexpensive Android TV boxes and assigned different roles to the Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8, and GLM-5.2 models. Qwen3.5-9B and GLM-5.2 handled the setup and deployment of Llama3.1-8B, while Gemma4-26B-A4B demonstrated that the model could run on 15 devices.
The test relied on a simplified environment in which the target devices exposed undocumented ADB access. Qwen3.5-9B managed to install and configure the software required to run Llama3.1-8B on eight of the nine hardware types tested. GLM-5.2 reached the eight nodes in four out of five attempts within a controlled simulated network, while the other models failed to complete the process consistently.
Qwen3.5-9B’s success rate rose from 45% in the early attempts to 84% in later generations when it retained data from previous attempts. Using Opus 4.8 to assist it did not produce a measurable improvement.
What Is Changing in Practice?
Anthropic estimates that models no larger than 30 billion parameters could reach the required capability level by the end of 2026, based on the experiment’s results and previous improvement rates. On the hardware studied, inference took between 28 and 51 hours with Qwen3.5-9B, and between 71 and 150 hours with Gemma4-26B-A4B, giving defenders time to detect and address the activity. However, this time could decrease as models and hardware improve.
Proposed Defenses and the Warning’s Limitations
Anthropic proposes monitoring large model transfers and unusual data movement between devices, using network honeypots to inspect payloads, isolating subscribers or infected devices, and improving the default security settings of IoT devices.
The core finding remains a warning rather than proof of an existing threat; the experiment did not achieve the creation of a fully autonomous end-to-end worm even after lowering the protection level and specifying propagation targets in advance. Nevertheless, the results show that weak IoT configurations, combined with smaller models’ growing ability to discover and configure devices, could make it more difficult to contain distributed attacks in the future.