Anthropic Warns Small AI Models Could Soon Power Self-Propagating IoT Botnets

Anthropic is warning that smaller AI models may soon be capable of spreading across poorly secured internet-connected devices without continuous human control.
The concern is not about a conventional botnet with fixed instructions. Instead, the company is looking at a future where an AI model could find a new device, get itself running there, and then continue the process from that machine. This comes as AI-powered cyberattacks are already rising across Asia.
IoT hardware is an obvious target because many devices are inexpensive, always connected and not particularly well protected.
Anthropic tested this idea across a mix of hardware and found that relatively small models can already handle several parts of the process. In one experiment, a 9-billion-parameter model was able to set up inference on eight of nine hardware types that were tested. The researchers say models under 30 billion parameters can already complete many of the individual steps involved in replication, although putting everything together reliably is still difficult.
The company also demonstrated that useful AI workloads do not necessarily need a traditional data center. 
Researchers ran a 26-billion-parameter model across 15 inexpensive Android TV boxes. Each device handled only a small part of the model, but together they were able to perform distributed inference.
That changes the way an AI botnet could look.
Instead of depending on one powerful server, a model could be split across many low-cost devices. Smart TVs, cameras, appliances and other edge systems could become part of a distributed pool of computing power.
Anthropic also tested whether models could move through a controlled network on their own. Of the models evaluated, GLM-5.2 was the only one that reliably completed the full replication chain in the simplified environment, reaching all eight target nodes in four out of five trials.
The researchers are careful not to describe this as a fully autonomous real-world AI worm.
Their conclusion is that the pieces are starting to come together. Small models are getting better at setting themselves up on unfamiliar hardware, working through failures and continuing from one device to the next.
For defenders, the issue is not just AI capability. It is also the large number of poorly secured devices already connected to the internet.
Anthropic says unusual device-to-device traffic, large model downloads, network scanning and outbound connection patterns could all become useful signals if this type of threat starts appearing outside the lab.