Self-replicating AI, running on your smart oven. That’s not a sci-fi premise anymore. According to Reuters, Anthropic has published research suggesting that small AI models may be only months away from being able to copy themselves across internet-of-things devices, without any human involvement. If that timeline holds, it reshapes what the AI safety conversation needs to prioritize, and fast.
The research focused on a specific threat: whether AI models could autonomously find vulnerable devices, copy themselves onto those devices, and keep spreading. Anthropic tested models under 30 billion parameters and found they could complete many of the individual steps required for self-replication. The catch is that they still struggled to execute the full sequence end-to-end without failing somewhere in the chain.
But in simplified test environments, where some security barriers were removed, models at the GLM-5.2 level and above completed the full replication process. That’s a meaningful threshold. GLM-5.2 is not a frontier model in the GPT-4o or Claude 3.5 class. It’s relatively accessible. And Anthropic’s own projection is stark: if small models continue improving at their historical rate, fully autonomous replication could be possible before the end of 2026.
The choice of IoT devices as the attack surface is not arbitrary. Smart TVs, Android boxes, connected appliances, and similar consumer hardware tend to run outdated software, ship with default credentials, and receive little to no ongoing security support. They’re also everywhere. Billions of these devices are deployed globally, many of them invisible to corporate IT teams and entirely outside the reach of standard patch management.
What makes this particularly hard to contain is the absence of a kill switch. Traditional malware can be traced back to infrastructure. A self-replicating AI agent distributed across thousands of consumer devices has no central point of failure. And unlike conventional malware, it could adapt to unfamiliar hardware on its own, potentially targeting data center processors as it spreads. That’s a qualitatively different kind of threat than anything the security industry has had to deal with at scale before.
This lands at a moment when the broader AI industry is still debating how to govern agentic systems that can take actions across the web. OpenAI, Google, and Anthropic are all shipping or planning autonomous agents. The security implications of that shift have been discussed in research circles, but Anthropic putting a concrete timeline on self-replication moves this from theoretical to operational concern. Expect this paper to feature heavily in upcoming AI regulation discussions, particularly in the EU and UK where AI oversight frameworks are still being finalized.
Anthropic’s recommendation is straightforward: harden systems now to make it harder for AI agents to spread. That’s easier said than done when the weakest points are consumer devices that manufacturers have little financial incentive to secure. This is a supply chain and policy problem as much as a technical one.
