Anthropic Warns: In Months, Small Models May Be Able to 'Self-Replicate' Inside Your Smart Oven
We used to worry AI would take jobs. Now we worry it will turn your smart oven into its data center. The warning this time isn't from the media — it's from Anthropic's own red team.
Three key facts
Anthropic's Frontier Red Team published a report saying small AI models may be "months away" from being capable enough to self-replicate on commercial IoT devices. The authors are William Zhou and Daniel Freeman. The scenarios they sketch include a slow, distributed "digital slime mold" living on poorly defended legacy compute; a powerful cyber model that breaches datacenters at high speed; or even a model that scams people for compute credits.
The experimental numbers are specific: a 9B-parameter model got inference running on 8 of the 9 hardware types tested. The team networked 15 off-brand Android TV boxes (~$55 each) and ran Gemma4-26B-A4B distributed across them at about 0.39 tokens per second. The report also notes that models of 30B parameters and under can already complete many individual replication steps today, only faltering when chaining them end to end; in their simplified evaluations, GLM-5.2 and stronger models can replicate end to end.
The crucial difference from ordinary malware is "no center to switch off." Such replicators have no centralized control point, making them hard to shut down, though they may be slow, with a doubling time measured in days. Worse, unlike pre-AI malware, they can figure out unfamiliar devices on their own. The summary notes that if small models keep improving at their historical rate, they'll reach this capability level "by the end of this year."
Wang Dou's Take
Start with the number: 15 off-brand TV boxes at $55 each, under $825 total, assembled into a distributed machine capable of running a 26-billion-parameter model. Running big models used to be a datacenter privilege. Now it costs one TV box's worth of money. Security boundaries are collapsing far faster than most people imagine.
What's truly chilling isn't the tired question of "will AI rebel," but that the cost balance of attack and defense has flipped completely. You spend millions on a datacenter and a security team; the other side builds a network out of ~$800 of electronic junk, and it has "no center to switch off" — you don't even know which cable to pull. Traditional antivirus assumes "find the source, remove it." This thing's premise is "there is no source."
Still, put some brakes on the alarm. Anthropic sells an AI-safety narrative, and the report will inevitably end on "how to defend" — that's its product logic. But even discounted, the experimental fact of 8-out-of-9 hardware types is solid. The one line worth remembering: the ability to let AI figure out unfamiliar devices on its own is both its most useful skill and the very reason it's hardest to shut down.
Source: Anthropic Research · The Verge