By Manuel Nau, Lead Editor at IoT Business News.
New research from Anthropic shows that small AI models may be able to automatically replicate themselves on vulnerable IoT devices. Experiments involving low-cost Android TV boxes show how distributed edge computing can support a new generation of adaptive malware.
IoT botnets have traditionally relied on relatively simple methods to spread, exploiting weak passwords, known vulnerabilities and insecurely connected devices. But what happens when malicious software can independently figure out how to operate unknown hardware, manage its own computing environment and change its deployment strategy?
Research published by Anthropic on October 12, 2026, suggests that this scenario may be technically possible. According to the company’s Frontier Red Team, advances in small AI models could enable autonomous, self-replicating software to operate on networks of compromised IoT devices without requiring access to powerful data center infrastructure.
These findings introduce significant changes IoT cyber security: connected devices may not only be targets for malware but also distributed computing resources that can run the AI systems responsible for spreading them.
Running AI Across Cheap IoT Hardware
One of the most famous research demonstrations is Gemma4-26B-A4B, a 26-billion-parameter AI model, on 15 low-cost Android TV boxes that cost about $55 each.
Each device contains 4GB of RAM and hosts part of the model using distributed inference. Together, the device achieves an inference speed of 0.39 tokens per second.
Although this performance is lower than that of modern data center GPUs, it shows that capable AI models can be used in networks of low-cost and resource-poor devices.
This distinction is important because traditional malware usually executes predetermined instructions, while AI-powered replicators can potentially interpret unfamiliar environments, solve software compatibility issues and determine how to make inferences on different hardware platforms.
Anthropic tested this capability separately using several open weight models. The 9-billion-parameter model successfully made inferences on eight of the nine types of hardware evaluated, showing a degree of adaptability that most conventional scripting malware does not.
Autonomous Replication Is Technically Feasible
The researchers also evaluated whether the AI agent could complete the replication cycle that includes finding the target device, transferring the software and creating a workable inference environment.
In a controlled experiment involving eight Android-emulated nodes, GLM-5.2 successfully propagated to all eight targets in four out of five trials, up to the remaining seven trials.
However, an important limitation remains: the experiment deliberately simplified the initial compromise stage by providing access through an unauthenticated interface. Larger models also run on a separate inference infrastructure instead of directly on the target device.
Consequently, the results do not show that autonomous AI worms have been able to propagate through real-world IoT networks.
However, they show that the model is sufficient to coordinate the replication process in controlled conditions, while the small model is increasingly able to perform the necessary inference tasks on limited hardware.
Anthropic estimates that, if current improvements continue, small models could reach the threshold of required capabilities by the end of 2026. This projection is based on general AI capability trends rather than direct evidence of IoT threats that can be replicated automatically.
Why AI-Powered Botnets Can Be Different
Central cyber security concerns don’t necessarily spread faster. In fact, Anthropic’s calculations show that early AI-driven worms operating on cheap connected devices could take days to replicate.
The more important difference is adaptability.
Traditional IoT botnets such as Mirai and Kimwolf generally rely on specific exploitation techniques and device categories. AI-based replicators can potentially configure themselves for different processors, operating systems and software environments, expanding the range of compatible targets.
The study also examines whether agents can improve their performance by transferring information between successive events. In one experiment, Qwen3.5-9B increased the success rate of the inference setup from 45% initially to between 61% and 84% in subsequent generations when records of previous attempts were kept.
This shows a potential mechanism by which AI-powered malware can be more effective in handling unfamiliar devices without requiring the underlying model weights to change.
Implications for Edge AI and IoT Security
These findings are particularly relevant as more connected products include local AI processing capabilities. Smart cameras, conferencing systems, industrial gateways and other edge devices are increasingly equipped with processors capable of performing machine learning workloads.
Anthropic’s experiments did not establish that the product category was inherently vulnerable. However, greater local computing capacity may make compromised devices more useful to attackers seeking distributed sources of inference.
For IoT manufacturers and system integrators, this introduces an additional dimension to device security: protecting computing resources against unauthorized AI workloads, instead of focusing solely on data theft, remote control or tampering.
The practical implication is that network behavior can be an increasingly important indicator of compromise. Distributed AI inference requires communication between participating devices, while moving model weights can generate a lot of network traffic.
Anthropic identifies these traffic patterns as potential detection opportunities, along with established measures such as secure default configurations, network monitoring and quarantine of infected systems.
There are also architectural trade-offs. Distributing inference across multiple inexpensive devices reduces reliance on centralized infrastructure, but creates communication requirements that make malicious activity observable.
For connectivity providers and enterprise IoT operators, monitoring unusual device-to-device traffic and unexpected data transfers can complement conventional endpoint security.
In the end, Anthropic’s research should be interpreted as an early warning rather than evidence of an impending autonomous AI epidemic. These experiments show that significant technical hurdles have been overcome, although reliable real-world replication remains unproven.
The broader implications are clear: as AI capabilities expand, IoT cybersecurity strategies increasingly need to consider software that can reason about its environment, adapt its behavior and potentially deploy without direct human intervention.