AI systems capable of spreading across connected devices may no longer require powerful data centre hardware, according to research published by Anthropic on October 12. The experiments suggest that smaller models are approaching the capabilities needed for autonomous replication, although the researchers have not demonstrated a complete rogue replicator.
Researchers William Zhou and Daniel Freeman ran a 26-billion-parameter model across 15 inexpensive Android TV boxes, each costing approximately US$55. Separately, a nine-billion-parameter model successfully established inference—the process of running an AI model—on eight of nine hardware types tested.
The replication results carry important qualifications. GLM-5.2 reached all eight nodes in four of five trials within a contained test environment. However, access to the machines was deliberately simplified, and the agent’s own model ran on a separate server. The experiment therefore measured replication competence under favourable conditions, rather than demonstrating an independently spreading AI system on consumer devices.
“We don’t yet have a full rogue replicator,” the researchers wrote. Their estimate that sufficiently capable small models could emerge by the end of 2026 is based on historical capability trends, rather than a confirmed deployment timeline.
The findings build on earlier research cited by Anthropic. A June preprint, AI Agents Enable Adaptive Computer Worms, reported an experimental worm that used AI to develop attack strategies suited to the machines it encountered. The authors tested propagation across a network containing Linux, Windows and Internet-of-Things devices, exploiting common corporate network vulnerabilities. Compromised machines supplied computing resources for running open-weight models and supporting further attacks.
That earlier work illustrates why researchers distinguish AI-driven worms from conventional malware. Traditional worms typically depend on predetermined vulnerabilities. An AI agent can instead interpret an unfamiliar environment and generate an approach for that target, potentially changing the task facing defenders. The preprint’s authors also argued that systems running on compromised hardware would sit outside commercial AI providers’ usual controls, including service refusals and rate limits.
Taken together, the studies point to a security issue extending beyond centralised AI infrastructure. For organisations, the practical implication is that connected-device security deserves attention alongside model governance: hardware that appears peripheral to an enterprise’s AI strategy could still become part of an attacker’s computing network.
