Anthropic Tests Autonomous AI Replication

Anthropic has shown that relatively small AI models can already complete many of the steps needed to copy and spread themselves across connected devices without relying on a data center. The experiment did not create an autonomous worm ready to act on the internet, but it shows that possibility is closer than it seemed.

The research focuses on cheap, poorly protected devices such as Android TV boxes, smart cameras, and other internet of things equipment. Instead of attacking servers with powerful graphics cards, a replicator could spread across hundreds or thousands of small machines and use their computing power as a distributed network.

What Anthropic achieved

The researchers tested whether several models could do something especially difficult: adapt an AI system to run on unknown hardware. That requires choosing compatible tools, installing the correct versions, fixing errors, and leaving an inference server running. Inference is the process through which a model generates responses.

The results show that:

• A model with 9 billion parameters got inference running on 8 of 9 hardware types tested.
• A Gemma4-26B-A4B model ran across 15 Android boxes costing around $55 each.
• On a test network of eight nodes, GLM-5.2 spread to 8 of 8 devices in four out of five attempts.
• Models with up to 30 billion parameters can already complete many individual steps, although they often fail to coordinate all of them in a single run.

In another test, Anthropic connected 15 devices with 4 GB of RAM to run the distributed model. The result was slow: around 0.3 tokens per second, far below the speed of a conventional AI service. The threat would not necessarily be fast. It could be persistent.

A slow worm that is difficult to shut down

A computer worm is a program that copies itself from one device to another without human intervention. An AI-based worm could include the model files, identify the type of device in front of it, adjust its strategy, and leave a new copy running.

That would set it apart from traditional malware. An attack programmed for a single type of device will often fail when it encounters a different system. An AI agent, by contrast, can try to diagnose its environment and find another way to continue.

Anthropic estimates that a replicator of this type would take between one and two days to complete a new copy on modest hardware. For comparison, the researchers imagined a network the size of a previous botnet that grew to more than two million devices. In that scenario, the network could run thousands of model copies, although its total capacity would still be small compared with that of a data center.

What the study still does not show

The experiment has important limitations. The test network used unauthenticated Android Debug Bridge ports, a condition much more favorable than that of most real-world systems. Anthropic also set aside the process of exploiting vulnerabilities to gain access to each device.

The results therefore represent more of an upper bound on what a model can do when it already has sufficient access. They do not show that a worm capable of autonomously infecting devices across the internet exists today.

The researchers also observed that small models improved when they inherited notes about errors and strategies from earlier generations. In one test, the success rate for Qwen3.5-9B rose from an initial 45% to between 61% and 84% in later generations.

For most people, this does not mean a TV box will start copying itself tomorrow. It does mean that connected-device security will have to account for more than weak passwords and known flaws. It will also need to prevent an automated agent from discovering how to adapt, persist, and coordinate. Anthropic estimates that small models with capabilities similar to GLM-5.2 could appear by the end of 2026 if current improvements continue. That is an approximate forecast, not an outcome already achieved.