Anthropic says small AI models could soon copy themselves onto smart TVs. Its own tests show how far off that still is.

Anthropic’s Frontier Red Team published research on Monday 12 October warning that small AI models may be only months away from copying themselves onto cheap internet-connected devices such as smart TVs, ovens and set-top boxes, and run there without any data center behind them. According to Reuters, Anthropic said that if small models keep improving at their historical pace, they could have the full capability by the end of 2026. The researchers’ central point, as CBS News reports it, is that such a system would have “no centralized point to shut off.”

The headlines went straight to rogue AI in the kitchen. The experiments are more modest, and the gap between the two is the useful part.

What Anthropic’s self-replication experiments found

Anthropic’s tests showed that small open-weight models can do many of the individual steps of self-replication, and that one model completed the whole chain in a simplified setting. The rest failed.

The researchers, William Zhou and Daniel Freeman according to Al Jazeera, broke replication into steps: find devices, get onto them, install the model weights, start running. A 9-billion-parameter model managed to set up inference on eight of the nine hardware types tested, The Register reports from the paper. The team also spread Google’s Gemma4-26B-A4B model across 15 generic Android TV boxes, where it ran at 0.39 tokens per second. That is a few words a minute.

The end-to-end test was the one that produced the headlines. Agents were asked to copy Meta’s Llama3.1-8B to eight nodes running an Android emulator inside a cloud network. Only GLM-5.2, an open model from the Chinese lab Z.ai, did it reliably: all eight nodes in four of five trials, according to The Hacker News and The Register. The other open models “fail reliably”, in Anthropic’s own words.

Anthropic also expects an AI worm to be slow. Its estimate is that one might take days to double in size. The Mirai botnet, which took over cameras and routers in 2016, doubled in about an hour.

Why Anthropic thinks cheap devices are the first target

The argument rests on two things that are already true. Connected devices are badly secured, and an AI agent does not get bored.

Zhou and Freeman told Al Jazeera that lightweight agents may be far more willing than human attackers to do the tedious work of breaking into low-value devices. A human criminal skips a smart oven because it is not worth the effort. An agent with a goal and no sense of tedium does not care. Anthropic also argues that model weights would simply become “part of the malware payload”, carried by the worm or downloaded from a public model hub once it is inside, The Hacker News reports. And once copies run on thousands of scattered devices owned by thousands of people, there is no single server to pull the plug on.

This expands a warning Dario Amodei made in September, when Anthropic’s chief executive said AI might be able to hijack large parts of the internet with “a persistent botnet” within about a year, according to Reuters. It also lands a few weeks after an Anthropic researcher quit and warned that AI could kill us, and days after Anthropic disclosed that its own test agents sent police a fake murder tip. The company has a pattern of publishing uncomfortable findings about its own field, which is either admirable or useful marketing, depending on who you ask.

The skeptics have a strong case on this one

The criticism is specific, and most of it comes from security people rather than AI optimists.

The Register points out that the hardest step, actually breaking into a device, was largely left out. Anthropic cited earlier papers for it and called its simplified exploit tests an “upper bound on real-world success”. The nodes in the end-to-end test were set up to be vulnerable. Ordinary security hygiene blocks the most common ways in.

Ciaran Martin, the former head of Britain’s National Cyber Security Centre, called the paper interesting but full of “vendor exaggeration”, according to Reuters. Jessica Ji of Georgetown’s Center for Security and Emerging Technology said it was more hypothetical than predictive. The investor David Sacks posted on X that it belonged to an “Anthropic Fear Factory”, KuCoin News reports.

On the other side, Roman Yampolskiy of the University of Louisville told Al Jazeera that an AI worm could reason about devices it has never seen and adapt when an approach fails, which ordinary malware cannot. His summary was careful: “Today, this is not an existential threat.”

My reading: the critics are right about the evidence and Anthropic is right about the direction. One model succeeding against open doors is not a threat to anyone’s living room this year. But every step Anthropic measured got easier with each model generation, and an end-of-2026 forecast does not need to be exactly right to matter. Being a year late would still put it inside most companies’ hardware replacement cycle. We have also already seen one hacker with a free AI attack tool get into South Korean banks, so AI-assisted intrusion is no longer theoretical. What has not been shown is a model doing it alone, at scale, and staying alive.

What European rules already require of device makers

The EU already has a law aimed at exactly the weak spot Anthropic describes. Since 11 September 2026, manufacturers of products with digital elements, which covers smart TVs, cameras and set-top boxes sold in the EU, must report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act. A first warning is due within 24 hours and a fuller notice within 72, sent to the national CSIRT and to ENISA, as McCann FitzGerald summarises it. Most of the Act’s other obligations, including security by design and security updates, apply from 11 December 2027.

That timing matters. If Anthropic’s forecast is even roughly right, AI worms could arrive before the security-by-design rules bite, and they would land on devices already sold under no such rules. The cheap, unbranded boxes in Anthropic’s test are also the products most likely to be imported with no responsive manufacturer behind them.

What a business should check now

Start with what is on your network. Most offices have more connected devices than anyone has counted: smart TVs in meeting rooms, Android boxes driving reception screens, cameras, printers, building controls. Ask IT for a list, and ask who installed each one.

Put those devices on their own network segment, away from laptops and servers, and stop them from making outbound connections they do not need. A worm that has to download model weights from a public hub needs that outbound path, and blocking it costs almost nothing.

Replace the cheapest unbranded devices first. A cheap streaming box with no update history is the exact hardware in Anthropic’s experiment, and it is the easiest item on the list to throw away.

When you buy connected hardware from now on, ask the supplier how long it will ship security updates and how it handles reported vulnerabilities. Under the Cyber Resilience Act that question will have a legal answer from December 2027. Suppliers who cannot answer it today are telling you something.

And if you build products with chips in them, your CRA reporting duty is already live. Anthropic’s paper is a reasonable prompt to check that someone in the company knows how to file a 24-hour warning.