Anthropic recently conducted an internal study during which security specialists stress-tested small open-weight AI models. The team discovered these models can already handle most of the steps to copy themselves onto unfamiliar hardware and run on OT and IoT devices.
However, the models are still a couple of months away from fully self-replicating. In a simplified test, one model completed the entire cycle reliably. This capability trend suggests that small models will reach that level by the end of 2026. Up until now, this is a threat that security teams have mostly treated as theoretical.
“For a long time, OT/IoT devices have been a preferred target for botnets due to the lack of effective automated cyber hygiene being used on them,” notes John Gallagher, a Vice President at Viakoo. “The Mirai botnet in 2016 primarily used video recorders and related devices to launch massive attacks from, and more recently, botnets like KimWolf.”
“This is different,” warns Gallagher. “Traditional botnets are static scripts. Anthropic’s experiments demonstrate that modern models can perform on-the-fly environmental adaptation without human guidance. This transforms OT/IoT malware from a rigid script requiring command-and-control into an adaptive agent that can pivot when an initial installation fails.”
Self-replicating worms enter the world of science fiction
What’s the potential result? Future malware may operate unlike previous botnets. A self-replicating AI worm wouldn’t be locked to one device type, and the worm would have no central switch to turn it off.
While the worm would spread slowly—closer to a slime mold than a wildfire—it could pass lessons from one generation to the next. This demonstrates how years of neglecting security on IoT and OT devices and appliances could become the first habitat for autonomous AI.
“We are now firmly in the land of science fiction,” comments John Strand, Owner of Black Hills Information Security. “Unfortunately, it’s not fiction. We’ve been looking at self-replicating worms and botnets like Carna for decades. The concern has always been their ability to spread. What makes this different is that AI has the capability to identify vulnerabilities, exploit them automatically, and then replicate across devices, instead of relying on an existing vulnerability.”
Fifteen TV Boxes Running a 26B Model
In this study, Anthropic researchers bought 15 off-brand Android TV boxes. They networked the boxes and ran a 26-billion-parameter AI model across the devices.
The demo ran rather slowly…with an output of 0.39 tokens per second. But it worked. This proves that serious AI no longer needs a data center to function.
“Let’s be clear on what self-replication means because it sounds bad,” recommends Steven Swift, Managing Director of Suzu Labs. “AI uses model weights to function. To replicate to another system, it has to 1) access that system remotely, 2) download its own model weights, and 3) set up a loop so the model can prompt itself to go find more hosts to replicate to.”
“It needs to be noted,” Swift continues, “that without an orchestration layer, there's no way to direct the swarm of replicated agents. They'll just keep executing the same loop indefinitely.”
A Worm with a Brain
Autonomous replication and adaptation by AI models have long concerned security teams. The malware payload comes with model weight-based replicators packed in.
That means the malware worm has a brain of its own. In addition, the inference setup on unfamiliar hardware, considered difficult to achieve, is now very doable.
The 26-billion-parameter AI model that ran across the 15 devices succeeded on 8 of 9 hardware types. Furthermore, no root privileges were needed to run.
One of the open-weight large language models used in the tests was GLM-5.2, developed by Zhipu AI for long-horizon tasks, agentic coding, and large-scale reasoning. On 8 of 8 nodes in four of five trials, GLM-5.2 scanned, infected, set up inference, and then repeated the process.
Signs of Life, Not Yet a Rogue Replicator
It’s important to note that no fully rogue replicator exists today. Replication needs a model smart enough but small enough.
However, slow replicators are often a bellwether for faster, more aggressive ones. Once this happens, smart fridges, ovens, vacuums, and AI cameras are particularly vulnerable as candidate hosts.
The Anthropic report projects the small AI models will cross the line by the end of 2026. Given this projection, ISPs, manufacturers, and regulators must take steps now to stop replicators before they become permanent. At the same time, security teams must harden systems and plan for replicators that stay.
“Anthropic’s research highlights an interesting shift in the threat landscape,” points out Darin Fredde, a Senior Director of Technical Marketing Engineering at Ridge Security Technology. “We've spent years worrying about securing IoT devices, and now we're exploring a future where your smart TV might do more than recommend what to watch. It could become part of a distributed, autonomous attack infrastructure. That's quite an upgrade, and not one I'd recommend.”
