Local AI by Editorial Team

Anthropic: Small AI Models Could Self-Replicate on Your IoT

A new study shows 30B-parameter models on $55 TV boxes are months from being able to act as autonomous worms. What self-hosters need to know.

If you self-host an LLM at home, you already know that the same small, open-weight models that make local AI viable also make local AI dangerous. Anthropic’s Frontier Red Team put a number on that this month. On October 12, 2026, William Zhou and Daniel Freeman published a post titled “AI models may be capable of self-replicating without access to a datacenter.” The team showed that a 26-billion-parameter model, Gemma4-26B-A4B, can be split across fifteen $55 off-brand Android TV boxes and still run inference. They also showed that a 9-billion-parameter model, Qwen3.5-9B, can stand up an inference server on 8 of 9 hardware types the team tested, including Jetson Nanos, Mac PCs, and RTX 4090s. The number that should stop a self-hoster mid-sip is the next one: a 30-billion-parameter model, on hardware you can buy for under $1,000, is months away from being able to autonomously replicate across a fleet of consumer IoT devices.

What Anthropic actually tested

The team built two rigs. The first was the TV-box cluster. The researchers took 15 off-brand Android TV boxes, each priced at about $55 with 4GB of RAM, networked them together, and ran Gemma4-26B-A4B across them with 4-bit quantization and pipeline parallelism. The model generated output at 0.39 tokens per second, per Anthropic’s writeup. That is glacial for chat but enough for a worm that only needs to push tokens through a slow loop. The second rig was a firewalled Google Cloud VPC of 8 nodes running redroid, an Android 15 emulator. Each node had Android Debug Bridge open with no authentication, a configuration Ars Technica’s Dan Goodin notes is “used during development and debugging but should never be used in production settings, because it gives attackers access to the entire device stack.” The worm, run by GLM-5.2 (a large, capable model that Anthropic used to simulate what a future small model would do), propagated from one node to the next, stood up inference for Llama3.1-8B on each new victim, and reached all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. Anthropic’s blog post calls these “weight-based replicators,” and notes that the weights themselves become part of the malware payload.

This is a capability demo, not a self-willed worm. The propagation in Anthropic’s test was orchestrated by GLM-5.2, not by a small model. Quoted in Ars Technica, AI researcher Xiaohan Fu said: “Despite the well-designed experimental setup, the study does not, on its own, establish that small models would autonomously choose to replicate.” That is the most important caveat. What the study does establish is that the wiring works: a small model can stand up inference on devices the operator did not preconfigure, the inference-setup step that earlier research treated as the bottleneck no longer blocks end-to-end replication, and the chain can run without root.

The bigger picture: AI worms in 2026

This is the second 2026 paper to show that an open-weight LLM can act as the engine of a self-replicating worm. In June, The Hacker News reported on a preprint from the University of Toronto’s CleverHans Lab led by Nicolas Papernot, in which an LLM-controlled worm scanned a 33-host test network spanning Ubuntu, Debian, Rocky Linux, Alpine, Windows Server variants, and IoT devices, found a mean of 31.3 vulnerabilities per run, exploited 23.1 hosts on average, and replicated to 62 percent of the network over seven days. Per the report, the worm reasoned at runtime over an exploit chain that included SambaCry with cron privilege escalation, Dirty Pipe, PrintNightmare, Drupalgeddon 2, Exim RCE, blind SQL injection, JWT bypass, and Redis escape, and separately chained post-training-cutoff CVEs CVE-2026-39987 (Marimo RCE), CVE-2026-31431 (CopyFail), and CVE-2026-43284 / CVE-2026-43500 (DirtyFrag) for an 41-of-67 root rate by reading public advisories at runtime. The Toronto worm assumed a GPU on the target. The Anthropic work assumes a $55 TV box.

Both projects converge on the same hardening point. The Toronto team writes that “the cost shifts from rented API access to whatever compute the worm can capture. Once a GPU-capable victim infrastructure exists, the attacker no longer pays per attempt.” Anthropic pushes the same point one step further: the worm can run entirely in userspace, no root required, and many low-end IoT devices can simply be re-infected on reboot, the same pattern as the P2Pinfect and Fritzfrog botnets Goodin cites.

What This Means

The self-host rig is not the target. The target is the smart fridge, the smart oven, the vacuum, the lawnmower, the security camera, all of which Anthropic lists as plausible homes for a weight-based replicator, and all of which are likely to be on the same home network as a self-hosted Ollama or llama.cpp box. The right framing is that the same forces that made local AI viable, open weights, small quantizations, cheap hardware, are also making the AI worm viable. If you already segment IoT off your LAN, keep Android Debug Bridge off every Android-based box that does not need it, and let your router deny inbound ports by default, you are doing the bulk of the work that this kind of worm does not expect. The same advice applies whether the model on the device is a chatbot, a vacuum’s path planner, or a worm. The consumer-IoT and self-host overlap is not hypothetical: Go-based botnets have already been caught scanning for exposed Ollama and Open WebUI instances, the same class of target the Anthropic rig is built to look like.

The capability horizon is dated. Anthropic’s trend line for open-weight model capability, an Epoch Capabilities Index fit with a 13.7 point gain per year and an R-squared of 0.95, puts a 30B-parameter model at GLM-5.2’s replication ability by the end of 2026. Anthropic’s conclusion: “small weight-based replicators may be possible soon after.” That is the sentence to take to a friend who still thinks the AI-worm story is a datacenter problem.

The Bottom Line

Anthropic’s Frontier Red Team has shown, on $55 Android TV boxes, that open-weight 30B-parameter models are months from being able to autonomously replicate across consumer IoT devices. The lab demo used GLM-5.2, a much larger model, to do the propagation, so this is not a working self-replicating worm in 2026. It is a clear, dated capability horizon, and a reminder that local-AI hardening and IoT hardening are now the same job.