Anthropic Research Demonstrates Potential for AI Models to Spread Across IoT Devices
Summary
Anthropic tested AI models’ ability to spread a payload across Android devices, finding GLM-5.2 could reach most nodes under highly favorable conditions. The study did not demonstrate a practical, self-replicating AI worm.
Key points
- Researchers tested whether low-cost Android TV boxes could collectively host an AI model, distributing Gemma4-26B-A4B across 15 devices.
- In a separate experiment, models attempted to find targets, copy a payload, set up inference, and continue propagation across an eight-node Android network.
- The tests allowed unauthenticated Android Debug Bridge access, making them an upper-bound capability demonstration rather than a realistic attack scenario.
- Only GLM-5.2 reliably completed the end-to-end workflow, reaching all eight nodes in four of five trials and seven nodes in the fifth.
- Anthropic did not demonstrate an attacker creating a self-replicating AI worm from a low-end open-weight model.
- Researchers said smaller models could catch up if they continue improving, but experts cited practical hurdles including bandwidth and device storage constraints.
Article Details
- Event Type
- Anthropic research demonstrating AI models' ability to perform steps involved in worm-like propagation across an isolated Android network under favorable experimental conditions.
- Impact
- The study did not demonstrate an AI worm self-replicating across a real-world network. Only GLM-5.2 reliably completed the end-to-end workflow in the experiment, which allowed unauthenticated Android Debug Bridge access. The researchers and cited experts describe practical AI self-replication as a potential future risk, with barriers including moving large model weights over low-bandwidth connections and onto constrained storage.
People
Chris GroveDirector of cybersecurity strategy at Nozomi Networks; commented on the defensive risks of self-propagating threats.Daniel FreemanAnthropic researcher and co-author of the study.John GallagherVice president at Viakoo; commented on practical barriers to AI self-replication.William ZhouAnthropic researcher and co-author of the study.
Vendors
Products
Androidenough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes."Gemma4-26B-A4BResearchers successfully ran Gemma4-26B-A4B, a version of Google's Gemma 4 open-weight model with 26 billion total parameters, distributed over 15 inexpensive, off-brand Android TV boxes. The devices, priced atGLM-5.2of open-weight models to act as agents, including Qwen3.5-9B, Gemma4-26B-A4B, Qwen3-Coder-Next, and GLM-5.2, all spreading a version of Llama3.1-8B as a "worm" payload. Instead of testing whether models could copyGoogle Cloud Platformseeded a single node in an isolated 8-node Android network, built via an emulated network in Google Cloud Platform (GCP), and instructed various AI models to autonomously spread from one node to the next.Llama3.1-8Bincluding Qwen3.5-9B, Gemma4-26B-A4B, Qwen3-Coder-Next, and GLM-5.2, all spreading a version of Llama3.1-8B as a "worm" payload. Instead of testing whether models could copy and execute their own weights onQwen3-Coder-Nextstudy tested a number of open-weight models to act as agents, including Qwen3.5-9B, Gemma4-26B-A4B, Qwen3-Coder-Next, and GLM-5.2, all spreading a version of Llama3.1-8B as a "worm" payload. Instead of testing whetherQwen3.5-9BThe study tested a number of open-weight models to act as agents, including Qwen3.5-9B, Gemma4-26B-A4B, Qwen3-Coder-Next, and GLM-5.2, all spreading a version of Llama3.1-8B as a "worm" payload. Instead of testing