Anthropic conjures another threat that doesn't exist yet to stoke fears of AI apocalypse

Nothing sells AI products as well as fear.

Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it came true.

The frontier lab published a research report Monday suggesting that AI models could eventually self-replicate without relying on datacenter hardware, with a 9-billion-parameter model successfully setting up inference on eight of the nine hardware types Anthropic tested.

“A replicator like this would be challenging to shut down, since there’s no centralized point to shut off,” Anthropic warned, adding that such an AI worm could also suss out the workings of unfamiliar devices, potentially making it more adaptable than conventional botnets like Mirai, Kimwolf (the representative IoT botnet threat model used in the study), and others.

Anthropic’s researchers managed to get a distributed instance of Gemma4-26B-A4B running across 15 generic Android set-top streaming boxes - a common target of traditional botnet malware due to their lax security.

Once up and running, the distributed Gemma4 model was able to conduct inference tasks at a blistering 0.39 tokens per second.

That, says Anthropic, proves that AI models can conduct inference with their various layers distributed across cheap hardware, but it doesn't prove such a model could self-replicate.

For that, the researchers turned to Z.ai’s GLM 5.2.

GLM was used to propagate a copy of Llama3.1-8B across eight Google Cloud instances running an Android 15 emulator in a virtual private cloud, which Anthropic said it was able to do with a high degree of success, with the model successfully spreading to all eight nodes in four out of five trials, and seven of eight in the other.

“It appears that GLM-5.2 is able to propagate Llama3.1-8B well, which suggests that future small models of the same capability level could also complete the network enumeration, payload delivery, and inference standup steps of the replication process,” Anthropic explained.

Sanity check: This isn’t going to end the world, either Frontier AI labs have become adept at publishing findings that portend doom that only they can prevent.

Doing more than a cursory reading of this report suggests that this threat is just as deserving of a big, honking asterisk as the rest.

Take, for example, what is needed for an AI model to exploit vulnerabilities and spread to various systems.

One would think that such an element would be an important part of demonstrating the danger of a self-replicating AI botnet, but Anthropic decided it didn’t need to worry about that for this study.