Anthropic Says Small AI Models Could Copy Themselves Onto Home Devices

In a firewalled test, one AI model spread across 15 Android TV boxes that cost $55 each. Anthropic’s Frontier Red Team says small models may soon be able to copy themselves across internet-connected home devices such as smart TVs, fridges and ovens. A former UK cyber chief calls that warning overstated.

How AI could copy itself onto smart TVs and fridges

Anthropic published the research on October 12, written by researchers William Zhou and Daniel Freeman. It found that small models could copy themselves onto commercial internet-of-things hardware, according to ThePrint and Startup Fortune.

The work came from the unit that tests whether models could cause harm. That makes these the company’s own experiments, run in a simplified environment rather than on real home networks. This account relies on secondary coverage, including Anthropic’s blog post as summarized by SAN, because the primary documents were not reviewed directly.

Why a 9-billion-parameter model is enough to worry researchers

The threshold matters most. ThePrint reports that models with roughly 9 billion parameters already show a strong ability to set up and run inference on many unfamiliar pieces of hardware. AI Weekly goes further, saying models of 30 billion parameters or less can already perform many of the individual steps.

That matters at home because the hardware in the test was ordinary consumer gear. Newer smart-home devices are increasingly shipping with AI chips, which could give a spreading model more processing power, according to Yahoo Finance. The story also landed in the same news cycle as reports of hackers breaking into internet-connected refrigerators in French grocery stores, which made the consumer angle easy to grasp.

Which models were tested and how the spread worked

The team tested five models in the simulated fleet: Qwen3.5-9B, GLM-5.2, Gemma4-26B-A4B, Llama3.1-8B and Anthropic’s own Opus 4.8. Gemma4-26B-A4B spread across the 15 Android TV boxes, which cost $55 each. At that price, the hardware bill came to roughly $825.

GLM-5.2, an open-weight model, completed full end-to-end replication. It reached all eight target nodes in four of five trials, which is the result that gives the warning its weight.

The replication chain was split into four stages:

• Finding vulnerable machines.
• Breaking in and delivering a payload.
• Getting inference running on the new hardware.
• Replicating again.

The chain is a useful frame for defenders. Each stage is a point where a device could be hardened, whether through the network it sits on, the services it exposes, the firmware it runs or the compute it can spare.

What Anthropic says is not happening yet

Anthropic’s blog post said there is not yet a “fully rogue replicator,” but that small models may replicate slowly, possibly taking days, as SAN reported. That distinction matters. The company is describing a slow spread that a defender could notice, not a fast outbreak.

Al Jazeera quoted the researchers as saying models “may be months away from being capable enough,” a phrase that points to a near-term horizon rather than a current outbreak.

The timing is disputed. Ars Technica, as relayed by Slashdot, says “by next year.” ThePrint reports “by the end of this year.” The gap between those forecasts decides whether households have months or a year to prepare, and independent testers should pin it down.

Scientific American reads the work as stopping short of demonstrating the full threat. That reading fits the test design: the experiments show capability in a controlled fleet, not a spreading worm in the wild.

Skeptics call the warning hype

Expert opinion is split. Some security researchers say the warning is real, while others call it vendor hype, according to Startup Fortune. A former UK cyber chief calls it exaggerated. The sources reviewed do not report a real-world self-replicating IoT worm, and the tests ran in a firewalled setting.

Skeptics have a fair point. A lab result is not an outbreak. There is also a commercial angle, since Anthropic sells AI models, so critics can reasonably ask who benefits from a warning about AI spreading. The company’s red team has a reason to find risks, and outside researchers have a reason to test whether those risks hold. Neither incentive makes the findings false, but both argue for independent replication.

The stronger argument for taking the warning seriously is structural. As ThePrint quoted the Anthropic researchers, “A replicator like this would be challenging to shut down, since there’s no centralized point to shut off.” Most malware can be contained by blocking the server that controls it. A model that spreads from device to device would leave no single machine to seize.

What home users and small IT teams can do now

No US agency has announced consumer-facing action tied to this research in the sources reviewed. The steps below are general security guidance, not recommendations from Anthropic or the sources.

• Update firmware on TVs, streaming boxes, routers and appliances, and turn on automatic updates where the device offers them.
• Change default passwords on every connected device, and use a unique password for each one.
• Turn off features you do not use, such as remote access or voice services you never enabled on purpose.
• Put smart-home gear on a separate guest network so it cannot reach laptops, phones and files.
• Retire devices that no longer receive security updates, and check a vendor’s update policy before you buy.

The people most exposed are households with older connected TVs, streaming boxes and appliances that no longer get updates. Small businesses face a related problem. An IT team cannot patch a device it does not know about, so the first job is an inventory of every connected TV, router, camera and appliance on the network. Device makers with short support windows will likely face the sharpest questions.

What to watch next

Watch for the full paper and independent replications, since the findings currently rest on the company’s own tests and on secondary coverage of them. Watch also whether device makers respond with statements on update support, because that is where most home defenses start. The timing dispute will only close if outside researchers run similar experiments on hardware people actually own.

Related reading: India’s CERT-In says AI agents read live business records unnoticed, a sign that regulators elsewhere are already worried about AI access that goes unseen. Open-weight releases are spreading too, such as Reflection AI’s Beam model under an Apache 2.0 license, which makes capable models easier to download and run.