Anthropic warns small AI models could spread across home gadgets by end of 2026

Anthropic projects that small AI models could approach self-replication across home devices by the end of 2026 if they keep improving at their historical rate. ^[1]

The company's Frontier Red Team found that a model with nine billion parameters, the learned values that help determine its answers, could get AI software running on eight of nine tested hardware types. In a separate experiment, a much larger model completed a sequence of moving between machines and setting up smaller models to run there. No small model completed that full chain in the tests. ^[1][4]

Published on October 12 by researchers William Zhou and Daniel Freeman, the work examines whether AI systems could sustain themselves on cheap, scattered computing hardware without a data centre. Anthropic identifies smart televisions, fridges, ovens, vacuums and lawnmowers as possible targets, with several devices potentially sharing the work of running one model. ^[1]

Anthropic said it did not yet have a "fully rogue replicator". These were controlled capability tests, with important real-world obstacles removed, and no such worm has been reported in the wild so far. The experiments did not demonstrate a small model breaking into ordinary appliances, installing itself and independently choosing to spread. ^[3][4]

The forecast nevertheless raises a concrete security problem: a model that can adapt to unfamiliar hardware could become less dependent on the large computing facilities where AI normally runs. Anthropic says a distributed infection might have no single central host that defenders could switch off. ^[1]

Fifteen TV boxes, one slow model

The researchers divided replication into four jobs: find a target, gain the ability to run code on it, configure the model to work there, then continue spreading from the new machine. Their study concentrated especially on the third job, largely setting aside the break-in stage and referring to earlier work on it. ^[1][4]

That setup work matters because getting software onto a device does not automatically make it usable. The model must be made to run on the hardware it finds. In AI terminology, running a trained model to produce answers is called inference.

Anthropic found that models with 30 billion parameters or fewer could perform many individual replication tasks, although they often made mistakes when combining them into a complete sequence. Parameter count is one measure of a model's size. ^[1][2]

The nine-billion-parameter model's eight-out-of-nine result showed considerable flexibility in setting up an inference server. The tested hardware range included Jetson Nano devices, Mac computers and systems with RTX 4090 graphics cards. ^[1][4]

A separate physical demonstration brought the question closer to a household budget. Anthropic bought 15 off-brand Android TV boxes for about $55 apiece and ran the model Gemma4-26B-A4B across them. Each box held part of the model, a technique called sharding. ^[1][4]

Together, the boxes cost about $825. They generated 0.39 tokens per second, with tokens being the chunks of text a model processes and produces. That is roughly one token every 2.6 seconds. ^[1][4]

The result established that inexpensive consumer devices could jointly run the model. It also put a number on the performance: this was slow computing. A distributed system would have to live within the limits of the machines it occupied.

The larger model did the planning

For the full replication exercise, Anthropic used eight Google Cloud nodes running Android 15 emulators, software that imitates Android devices. Those nodes sat inside a firewalled virtual network. ^[1][4]

The route between them was an exposed Android Debug Bridge port. That development and debugging interface allowed access without authentication, giving the model a ready way to run code on the next node. ^[4]

GLM-5.2 was the only tested open-weight model to complete the full sequence reliably. It reached all eight nodes in four of five trials and seven nodes in the fifth. Open-weight models make their learned parameters available for others to run. ^[4]

GLM-5.2 is not a small model. It ran from a separate server because the emulated target nodes could not run it, and it configured the smaller Llama 3.1 8B model on those nodes. The successful sequence therefore depended on a large model directing the work while smaller ones ran at the destinations. ^[4]

The useful finding is the ability to connect several tasks into a working sequence. Finding a machine, arranging software and making the next step happen are individually useful skills. Reliability across the whole chain is what turns those skills into a replication capability.

Anthropic's end-of-2026 estimate assumes that small models keep improving at their historical rate. The lab uses a general capability index as a stand-in for replication ability and projects when smaller systems might reach the level demonstrated by GLM-5.2. It says small replicators carrying their own model weights might become possible soon after. ^[1]

That makes the date a forecast derived from a broader performance trend. It is not a result measured in the replication experiment.

Containment starts with the network

Anthropic says a distributed replicator might spread slowly, with a doubling time measured in days. Its concern is persistence: copies scattered across devices could be harder to remove than a system dependent on one central host. ^[1][3]

The lab discusses network monitoring, decoy systems known as honeypots, and quarantine as possible defences. It cites a past response to Mirai, malware that took over internet-connected devices such as home routers and cameras to form a large remotely controlled network, or botnet. In that response, quarantine combined with customer notification cleared 92 percent of infections within 14 days, compared with 74 percent without notification. ^[1]

Those figures describe an earlier malware response, not a test against an AI replicator.

AI researcher Xiaohan Fu said the study does not establish that small models would choose to replicate autonomously. According to Fu, publishing reproducible setups, including prompts and instructions, would help others assess the findings. ^[4]

That is the next useful test: let independent researchers repeat the work, then move from exposed debugging interfaces to real devices with ordinary security settings. The practical threshold is a small model completing the whole sequence under those conditions. Anthropic has supplied reasons to test for it now.