# Room by room: what a self-copying AI could do in your house

> A walk through the connected house, device by device: what each one has, what has really happened to it, and what Anthropic's self-replication research says.

- Canonical URL: https://webofmike.com/self-replicating-ai-room-by-room/
- Author: Mike Moore (https://webofmike.com/about/)
- Published: 2026-10-20
- Last modified: 2026-10-20
- Tags: Generative AI, Security, AI Agents, Robotics
- Cite as: Mike Moore, "Room by room: what a self-copying AI could do in your house", Web of Mike (webofmike.com), 2026-10-20. https://webofmike.com/self-replicating-ai-room-by-room/


Last week I asked you to [count the connected things in your house](/self-replicating-ai-smart-home/). Parks Associates says the average US internet household has about 17 ([source](https://www.parksassociates.com/blogs/in-the-news/the-smart-home-in-2025-outlook-and-opportunities)).

This week we walk through the house and look at each one.

Quick recap. Anthropic's Frontier Red Team tested whether AI models could copy themselves onto cheap connected devices ([Anthropic](https://www.anthropic.com/research/self-replicating-ai)). Their answer: not yet, but the pieces are coming together. They also named the kinds of devices they think could host part of a model: "Machines that could run a significant model shard for a <30B model include smart fridges, smart ovens, automatic vacuum cleaners, and lawnmowers."

Same rules as last time. For every device I'll tell you what it has, what has really happened to it (with a link), what Anthropic's research says, and what I think. Anything marked "what I think" is my guess, not theirs.

## Living room: the TV and the streaming box

**What it has.** A real processor, a few gigabytes of memory, and an always-on internet connection. Many cheap boxes run a fork of Android that never gets updated.

**What's happened.** In 2025 the FBI warned that the BADBOX 2.0 botnet had infected more than one million home connected devices, including streaming boxes, projectors and picture frames ([FBI](https://www.fbi.gov/investigate/cyber/alerts/2025/home-internet-connected-devices-facilitate-criminal-activity)).

**What Anthropic showed.** This is the device they actually tested on. They ran a 26B model across 15 off-brand Android TV boxes at about $55 each. They also point to Kimwolf, "a large IoT botnet that infected over two million devices, primarily off-brand Android TVs."

**What I think.** If a self-copying model ever shows up in a house, this is where it shows up first. It's cheap, it's everywhere, and nobody patches it.

## Network closet: the router

**What it has.** Every packet in your house goes through it.

**What's happened.** In January 2024 the Justice Department said the FBI removed malware from hundreds of US small office and home routers. Most were end of life Cisco and Netgear models that no longer got security updates ([DOJ](https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical)).

**What I think.** The router is the best foothold in the house and the best place to catch one. It sees everything. That cuts both ways.

## Front door: the doorbell and the cameras

**What they have.** A camera, a microphone, a speaker, and more and more often a dedicated AI chip.

**What's happened.** The FTC says hackers got into the stored videos, live streams and accounts of about 55,000 US Ring customers, and used two-way audio to harass people, including children ([FTC](https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ring-employees-illegally-surveilled-customers-failed-stop-hackers-taking-control-users)). In a separate case, the FTC says a hacker reached over 150,000 live Verkada customer cameras in 2021 ([FTC](https://www.ftc.gov/news-events/news/press-releases/2024/08/ftc-takes-action-against-security-camera-firm-verkada-over-charges-it-failed-secure-videos-other)).

**What Anthropic says.** Security cameras "now ship with small built-in AI chips, designed to run AI models on the device itself. This extra computing power will likely make them attractive targets as well."

**What I think.** A camera with its own AI chip may be the strongest computer near your front door. We built it to watch for strangers. It's also a decent place for a stranger to live.

## The floors: the robot vacuum

**What it has.** Cameras, lidar, a microphone, wheels, and a map of every room you own.

**What's happened.** At DEF CON 32 in 2024, researchers showed they could take over Ecovacs robots over Bluetooth from as far as about 450 feet away, with access to cameras, microphones, WiFi credentials and saved maps ([TechCrunch](https://techcrunch.com/2024/08/09/ecovacs-home-robots-can-be-hacked-to-spy-on-their-owners-researchers-say/)). Later that year ABC reported Deebot X2s hijacked in several US cities, with attackers yelling slurs through the speakers ([ABC](https://www.abc.net.au/news/2024-10-11/robot-vacuum-yells-racial-slurs-at-family-after-being-hacked/104445408)). Ecovacs published patched versions in November 2024 ([Ecovacs](https://www.ecovacs.com/global/userhelp/dsa20241119)).

**What Anthropic says.** Vacuums are on their list of devices that could host a model shard.

**What I think.** This is the creepiest thing on the list. It's a computer that moves, sees, and already knows the layout of your house.

## The nursery: the baby monitor

**What it has.** A camera, a microphone, and not much compute.

**What's happened.** Bitdefender found an OS command injection flaw in the Owlet Cam, tracked as CVE-2023-6321 ([NVD](https://nvd.nist.gov/vuln/detail/cve-2023-6321), [Bitdefender](https://www.bitdefender.com/support/security-advisories/owlet-camera-os-command-injection/)).

**What I think.** Too small to host much of a model. More likely a stepping stone to something bigger on the same network. Smallest computer in the house, highest stakes.

## The kitchen: the fridge and the oven

**What's happened.** I couldn't find a verified incident to cite, so I won't invent one.

**What Anthropic says.** They name smart fridges and smart ovens directly as devices that could run a model shard. Their headline used "smart ovens" as an example.

**What I think.** Everything here is "possible," not "happened." A fridge is a computer you'll keep for a long time and probably never update.

## The walls: thermostat, bulbs, plugs and locks

**What's happened.** Nothing I could verify well enough to cite.

**What I think.** Most of these are too small to host a model shard. They matter for what they control, not for what they can compute. A lock doesn't need to think to be a problem. It just needs to take orders from something that does.

## The garage: the car and the EV charger

**What's happened.** In 2015 researchers took remote control of a Jeep Cherokee through its Uconnect system, and Chrysler recalled 1.4 million vehicles ([Wired](https://www.wired.com/2015/07/jeep-hack-chrysler-recalls-1-4m-vehicles-bug-fix/), [CISA](https://www.cisa.gov/news-events/ics-advisories/icsa-15-260-01)). At Pwn2Own Automotive 2024, researchers exploited home and commercial chargers, including the ChargePoint Home Flex, Autel MaxiCharger and JuiceBox 40 ([ZDI](https://www.thezdi.com/blog/2024/1/24/pwn2own-automotive-2024-day-one-results)).

**What Anthropic says.** Vehicles carry the same kind of edge AI hardware they tested. But "we expect cybersecurity to be a focal point for vehicles, so the majority of the potential targets likely lie in the other two categories." The other two are smart cameras and conferencing machines.

**What I think.** I agree with them on the car. The charger on the wall is the softer target.

## The bedroom: medical devices

**What's happened.** In 2019 the FDA and CISA warned that someone nearby could potentially change the settings on certain Medtronic MiniMed insulin pumps wirelessly, and the affected models could not be patched ([CISA](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-19-178-01)).

**What I think.** A model would never need to run on a device like this for it to matter. I'll leave it there.

## The part that ties it together

Anthropic makes two points that change how I read every room above.

First, "weight-based replicators don't need root privileges." The model can run as a normal program.

Second, "many of the low-security devices we anticipate such a replicator to spread on can be re-infected upon restart." Unplugging it and plugging it back in isn't a fix if the neighbor device just puts it back.

Every break-in above was done by people, or by scripts people wrote. What's new is a payload that can look at the device it landed on and figure out how to use it. That's my read, not a finding from the paper.

Which room in your house worries you most? Tell me, and that's next week's room.

And no, I didn't forget the bathroom.

Source: https://www.anthropic.com/research/self-replicating-ai