Count the connected things in your house. The TV. The doorbell. The robot vacuum. The thermostat. The router blinking in the closet.
Parks Associates puts the average US internet household at about 17 connected devices (source ). IoT Analytics expected 21.1 billion connected IoT devices worldwide by the end of 2025 (source ).
Every one of those is a small computer. A growing number can move. IFR counted about 20.1 million consumer robots sold in 2024 alone, mostly vacuums and other home helpers (IFR ). Amazon runs over 1 million robots in its warehouses (Amazon ). Robots won’t outnumber people anytime soon. Connected devices already do. This week Anthropic published research asking a new question about them. Could an AI model copy itself onto them and keep spreading on its own?
I care about this for a personal reason. I started in electrical engineering and test and measurement. I spent years with IoT hardware. Today I work in AI infrastructure. This is the first AI risk story where both halves of my career land in the same sentence.
So I read the whole paper. Here’s what it shows, what it predicts, and what I think.
We’ve seen the dumb version already
Mirai was dumb. It ran a script. It only knew the devices it was written for.
In 2025 the FBI warned that a different botnet, BADBOX 2.0, had infected more than one million home connected devices. That included streaming boxes, picture frames and car infotainment systems (FBI ).
Now imagine the payload isn’t a script. Imagine it’s a model that can read a device it has never seen and work out how to run on it.
What Anthropic showed
Their headline, in their words: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.”
Three results stood out to me.
A $55 box can run a real model. “We run Gemma4-26B-A4B, distributed over 15 inexpensive off-brand Android TV boxes (~$55 each) that we bought and networked together, at 0.39 tokens per second.” Each box held a slice of the model. It was slow, but it worked.
A small model can figure out hardware it hasn’t seen. “In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.” The range went from Jetson Nanos to Macs and RTX 4090s. I’ve done hardware bring-up. Wrong toolchain, wrong package version, a driver that breaks on the next chip revision. Each fix depends on the last one. A 9B model got through that on 8 of 9 hardware types.
One model did the whole loop. They built a closed network of 8 cloud machines running an Android emulator. The worm had to scan, get in, copy itself over, start running and repeat. GLM-5.2 “spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1.” The other models they tested failed reliably.
What Anthropic didn’t show
The viral version skips this part.
The break-in step was made easy on purpose. It was “trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success.”
The model that did the full loop was too big to live on those machines. “The worm’s model runs on a separate inference server.” The test asked whether a model with that skill could do the job. It did not show a small model doing it on its own hardware.
The “months” is a forecast. Anthropic projects small models reaching that level “by the end of 2026” and calls it “only a rough estimate.”
Their own bottom line: “We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain.”
What I think
Here’s the part that keeps me up a bit.
We already know the break-ins are real. The FTC says a hacker reached over 150,000 live Verkada cameras in 2021 (FTC ). Researchers took over Ecovacs robot vacuums over Bluetooth from about 130 meters away and got their cameras and microphones (TechCrunch ).
Those break-ins were done by people, or by scripts written by people. What Anthropic tested is what happens after the break-in. The payload can think about where it landed. Anthropic says it “could also figure out unfamiliar devices on its own.”
That’s my speculation, not theirs: the gap between “someone hacked a camera” and “a model set up shop on a camera” is getting smaller.
The good news is that it would be slow. Anthropic compares it to “a slime mold or a swarm of fruit flies,” with a doubling time of days. Slow gives defenders time, and it leaves tracks on the network. I’ll cover both in this series.
Coming up
- Room by room: what’s connected in your house, and what a self-copying model could do with each thing.
- How to read the “months away” forecast like a test engineer.
- Why slow is still scary.
- Where the off switch actually is.
- Why this isn’t Mirai.
- A thought experiment: what happens at 10%, 30% and 60% of devices.
Source: https://www.anthropic.com/research/self-replicating-ai
Go count the connected things in your house. Post your number. I bet it’s higher than you think.