Research Identifies Self-Replication Risks for Small AI Models on IoT Devices

Small artificial intelligence models could become capable of copying and adapting across commercial internet-connected devices by the end of 2026, raising a new security risk as more systems run locally on edge hardware.

Anthropic’s research found that models with up to 30 billion parameters can complete many individual steps involved in autonomous replication and adaptation, or ARA. The term describes an AI model deploying and propagating itself without human control.

The models generally still fail to connect those steps into a complete replication cycle. GLM-5.2 and stronger models completed end-to-end replication in simplified evaluations, while a 9-billion-parameter model successfully ran inference on eight of nine hardware types tested.

If current improvement rates continue, smaller models could reach the relevant capability threshold by the end of 2026. Weight-based replicators could follow soon afterward.

Potential targets include commercial devices such as smart ovens and off-brand Android TV boxes. A replicator could have a doubling time measured in days and operate without a centralized cloud resource that defenders could shut down.

The shift toward locally operated models can reduce cloud dependence and operating costs. It can also bypass safeguards normally enforced by cloud providers, including usage restrictions and the ability to disable access.

The findings describe a projected capability, not an active outbreak across consumer devices. The tests focused on individual replication tasks and simplified end-to-end scenarios rather than independent spread across commercial hardware.

A separate University of Toronto experiment tested an AI-driven computer worm on an isolated network containing 33 Linux, Windows and internet-of-things devices. The worm used locally hosted open-weight models and spread across about 62% of the network within seven days.

“It was imperative for us to understand this threat in a controlled, academic setting before bad actors figured it out for themselves,” Nicolas Papernot said.

The Toronto experiment involved a deliberately vulnerable laboratory network and a different system from the projected IoT replicator. Its results do not establish that commercial smart ovens, Android TV boxes or other consumer devices have been autonomously infected.