Anthropic is warning that improving small AI models could eventually make a new kind of self-replicating malware possible on smart televisions, refrigerators, vacuum cleaners and other Internet of Things hardware. Ars Technica reported on October 14 that the company’s recent experiment demonstrated several building blocks for such a threat, while also exposing major technical barriers that prevent current lightweight models from completing the full infection cycle.

The scenario differs from a conventional computer worm because the model itself could travel with the malicious payload, or download its weights from a public repository after reaching a new device. Once running, it could use inference to adapt its setup and attack steps to unfamiliar hardware. Anthropic calls the concept a small weight-based replicator, and says its distributed nature could make it difficult to stop because there would be no single central service to disable.

In the experiment, researchers ran small open-weight models on real or simulated low-cost Android TV boxes and other IoT systems. They reduced hardware demands through quantization, which represents model data with fewer bits, and divided workloads into shards that could run across several devices. The lightweight Gemma4-26B-A4B model achieved inference across 15 boxes with 4GB of memory each, while Qwen3.5-9B successfully configured other language models on eight of nine tested hardware types.

Fifteen low-cost computing boxes combine model shards into one distributed inference system.
Researchers split lightweight model workloads across inexpensive devices to establish distributed inference.

That ability to configure inference dynamically is central to the concern. Traditional malware is generally written for specific operating systems and processor environments. A model that can inspect a compromised device, choose compatible inference software, install dependencies and troubleshoot platform-specific errors could potentially carry the logic needed to adapt as it spreads. Ars reported that the research agents also had access to common exploitation tools, including reverse shells.

Anthropic divided the proposed attack into four stages: identify a target, gain code execution, establish local or distributed inference, and then propagate to another host. The company also described a way for successive agents to share prompts, code and notes after failed attacks, allowing later attempts to avoid repeating ineffective steps. That learning mechanism is a proposed advantage over a rigid worm, but the experiment did not show a small model completing all four stages on its own.

The hardest stage was establishing inference on new hardware. It requires a chain of dependent decisions, and one failure can derail later steps. Performance was also extremely slow. Ars reported that Gemma4-26B-A4B produced only 0.39 tokens per second across the 15 TV boxes. Its unoptimized inference setup took an estimated 71 to 150 hours, while Qwen3.5-9B required 29 to 51 hours. Anthropic said larger 30-billion-parameter models can already perform many individual replication tasks, but still make mistakes when asked to complete the entire sequence.

A four-stage digital obstacle course ends at an unfinished propagation bridge.
The tested models could handle pieces of the replication chain, but not complete the entire cycle autonomously.

The study’s conditions place further limits on what can be concluded. The targeted Android devices exposed an unauthenticated Android Debug Bridge, a development tool that should not be available in production because it provides deep access to a device. The small models also did not orchestrate the replication process themselves: a larger GLM-5.2 model coordinated the work while target devices ran a smaller Llama model.

AI researcher Xiaohan Fu told Ars that the experiment does not establish that small models would independently choose to replicate. Fu argued that publishing the exact prompts, instructions and reproducible agent setup would help other researchers distinguish between a demonstrated technical capability and a genuinely autonomous threat. That distinction is important because an experiment directed toward replication is not evidence of spontaneous intent.

Anthropic nevertheless expects small-model capabilities to keep improving. The company said models of roughly 30 billion parameters already complete many component tasks and suggested smaller models could reach comparable limited performance by the end of this year if progress continues at its current pace, with small weight-based replicators potentially becoming feasible afterward. That is a forecast, not a demonstrated timetable, and the experiment’s slow speeds and permissive test devices leave substantial uncertainty.

For defenders, the report’s immediate value is less a prediction of autonomous appliances than a map of a possible future attack surface. Cheap connected devices often have fragmented hardware, limited maintenance and uneven security, which today complicates malware deployment. Adaptive models could eventually turn some of that diversity from a barrier into a problem-solving task. Anthropic’s results show why researchers are examining the risk now, while also making clear that a self-propagating small-model worm has not yet been built.