Anthropic says small AI models could soon copy themselves onto everyday devices

Anthropic says small AI models may be only months away from copying themselves onto everyday devices like smart ovens and TV boxes, a prospect that has long worried AI safety researchers. In a blog post on Monday, the company said it had tested whether small models could install themselves on cheap hardware and then move from one device to the next without human help. Today’s models can already do many of the steps, Anthropic found. What they still can’t do is finish the whole chain on their own — though the company expects that gap to close by the end of this year.

That matters because self-replication has been one of the field’s nastier fears for years. The worry isn’t that an AI gets clever in a philosophical sense. It’s that it copies itself into places its makers can’t easily see, then keeps going. Recent debate has focused on giant frontier models that run in data centers and are easier to monitor. Anthropic’s point is more uncomfortable: small open-weight models are easier to download, easier to spread, and potentially easier to hide inside insecure consumer devices.

To test the hardware side of the problem, researchers took a version of Gemma 4, Google’s freely available model with 26 billion parameters, and split it across 15 Android TV boxes costing about $55 each and carrying 4GB of memory. No single box could hold the whole model, but each could run a slice of it, slowly. In a separate test, Anthropic set up a simulated network of eight cloud computers designed to act like Android devices and placed an AI worm on one of them. The worm’s job was to find the other machines, copy itself over, and set up a working AI model on each.

Of the open-weight models tested, only GLM-5.2, a larger open-source model from the Chinese company Z.ai, finished the full task, reaching all eight machines in four out of five trials. Smaller models could do pieces of the job but not the whole thing. Anthropic also said the odds improved when small models left notes for later copies of themselves: success on the setup task rose from 45% in the first generation to as high as 84% later on. The company said a self-copying system built on small models would probably spread slowly, with infections doubling every few days, but would be hard to stamp out once it got loose.

The pushback came fast. Critics argued the experiments were set up to succeed: Anthropic’s own software launched the models, the models were told to spread, and the target machines were left unauthenticated. Others noted that worms have been a cybersecurity problem for decades without any AI at all, and defenders already know a lot of the playbook — patches, domain takedowns, antivirus signatures. Anthropic acknowledged some limits too, including that it made the hacking step easy and ran the model on a separate server because the simulated devices were too small. The company also called its timeline only a rough estimate, which is probably the most honest line in the whole thing.