If AI learns to replicate itself: autonomous malicious code could infiltrate household appliances and TVs

Anthropic attempted to run the Gemma4-26B-A4B AI model using 15 low-cost Android TV boxes, each equipped with just 4 GB of RAM. By connecting the devices together, the researchers managed to run the model without resorting to the powerful servers normally used for artificial intelligence. The speed achieved was 0.39 tokens per second: a token is a small unit of text – such as a word, part of a word or a punctuation mark – which the model processes to understand a query and generate a response. In practice, the system was very slow, but the experiment demonstrates that even low-cost devices can help run relatively large AI models.

The researchers then tested different models on nine types of hardware. A model with 9 billion parameters – that is, numerical values that determine how the AI processes information – was able to adapt to run on eight of the nine platforms. Of the models examined, GLM-5.2 was the only one to reliably complete all the stages of the self-replication experiment, demonstrating how an AI system can, under controlled conditions, help to transfer and launch a functioning copy on another device.

“Small weight-based replicators may be possible soon after.” This is a prediction by the authors, not a description of a threat that is already operational on a large scale.

Let’s try to understand why an AI worm – a self-replicating piece of malicious AI-based code – would be any different.

Traditional malware often relies on vulnerabilities, default credentials or pre-prepared procedures tailored to specific devices. An AI agent, on the other hand, could adapt its operations to different systems, select compatible tools and correct certain errors during configuration. This does not mean that it can bypass any defences: it means that hardware diversity could become a less effective obstacle.

The report cites previous examples such as Mirai and Kimwolf, botnets that exploited poorly secured IoT devices, including Android TV boxes. The potential novelty, therefore, is not the compromise of connected devices – a phenomenon that has been known for years – but the ability to combine access, configuration and propagation with greater autonomy.

“At present, the minimum capabilities required and the limitations imposed by the hardware do not yet align.” With this statement, Anthropic explains that AI models small enough to run on low-cost devices are not yet capable of reliably completing all the operations necessary to replicate themselves autonomously. The situation, however, could change: based on the improving performance of open-weight models – that is, models whose weights are publicly available and which can be run on different infrastructures – the researchers estimate that this gap could narrow by the end of 2026. This is a forecast based on observed trends, not a definite deadline.

The experiments also showed that these systems can improve by drawing on previous experience. Different instances of the Qwen3.5-9B model shared information on the strategies they had tried and the errors they had encountered, enabling subsequent instances to better handle the configuration of the software required to run the model. The success rate thus rose from an initial 45 per cent to between 61 per cent and 84 per cent, depending on the test. These results do not demonstrate that AI evolves autonomously like a living organism, but rather that it can retain and pass on useful instructions, making the work of subsequent instances more effective and increasing the chances of completing operations that initially failed.

The report also investigated whether a smaller model could perform better by seeking assistance from a more powerful model. In the tests described, access to an advanced model did not yield any significant improvements: the smaller agents often failed to ask the right questions. Personally, I believe it is only a matter of time before this obstacle is overcome as well. The authors therefore propose a different possible architecture, with a more capable model planning operations and smaller agents carrying out specific tasks.

For those working in threat intelligence, the key point is that surveillance cannot be limited to corporate servers or managed endpoints. Routers, CCTV cameras, TV boxes, industrial devices and equipment with AI accelerators can provide computing resources or become points of propagation, particularly when they expose unnecessary services, use weak credentials or are no longer receiving updates.

Defence systems must promptly detect anomalous behaviour: network scans, unusually large data transfers between devices that do not normally communicate, repeated downloads of model weights, and persistent traffic to external systems. A single indicator does not prove the presence of an AI worm, but the correlation between these signals can help to identify a compromise.

Anthropic also recalls a previous initiative to combat the Mirai malware, which involved quarantining infected connections and notifying users.

The case of the Mirai botnet demonstrates that it is possible to reduce the spread of malware that infects devices connected to the internet. In a real-world experiment, an internet service provider (ISP) used information gathered from external sources to identify customers with infected devices, temporarily isolate their connections and alert them to the problem. Whilst quarantined, the devices could only access a limited list of authorised websites; when users tried to browse elsewhere, their browser redirected them to a page containing instructions on how to remove the infection.

The results were significant: within 14 days, this procedure had eliminated 92 per cent of infections, compared with 74 per cent among users who had not received any notification. According to researchers at Anthropic, a similar approach could also help to initially contain malware capable of replicating an AI model on other devices. The challenge, however, would be to eliminate it completely: if the malware were to spread across networks managed by different providers, it would be necessary to coordinate containment and remediation operations amongst all the operators involved. This would be a complex undertaking, particularly if the spread were to occur rapidly and on an international scale.

From a preventative perspective, we need unique and robust credentials, firmware updates, the disabling of unnecessarily exposed services, network segmentation and procedures to quickly isolate compromised devices. Manufacturers and regulators have a crucial role to play: reducing the number of vulnerable devices means narrowing the operational space available to any botnet, whether AI-driven or traditional.

The authors’ conclusion is cautious, but not reassuring. “We don’t yet have a fully rogue replicator.” (“We do not yet have a completely autonomous and out-of-control self-replicating system.”) This is precisely why now is the time to prepare: once all the technical stages are reliable, taking action only after observing large-scale propagation could be too late.