Your Smart Oven Could Be the Next Node in an AI Botnet: Unpacking Anthropic’s Self-Replicating AI Research

Anthropic recently published research that is well worth talking about—specifically around the risk of AI models capable of self-replication. Essentially, we are talking about an AI-driven worm that operates entirely outside of a traditional data centre. Frankly, it looks a tad worrying if you ask me.

Distributed Inference on Consumer Hardware

The Anthropic team developed a proof of concept targeting everyday Internet of Things (IoT) devices, such as Android TV boxes and smart ovens. While these devices are slow individually, chaining them together allows smaller models to distribute their workload across a cluster. This pooled compute provides the ability to run larger models that a single consumer device simply could not handle on its own.

Within Anthropic's evaluations, a 9B parameter model successfully ran inference across 8 out of 9 different hardware types tested.

A fleet of 15 Smart TVs running Gemma4-26B-A4B. Credit: Anthropic

The researchers note that models with 30B parameters and under can already complete many of the individual steps required for replication today. Because they still make mistakes from time to time, reliable end-to-end autonomous replication is still lacking at the time of writing. However, because an AI is inherently more agile than traditional static malware, it could theoretically adapt to unfamiliar environments at a rapid pace.

Why IoT is the Ultimate Low-Hanging Fruit

This research puts into perspective just how plausible it is for future worms to incorporate AI elements, strengthening the malware and making it significantly harder to disrupt.

Data centre GPUs are high-value targets and are heavily protected as a result. Consumer IoT devices, on the other hand, generally have far less baked-in security and are much easier to compromise. With approximately 21 to 22 billion IoT devices globally—including at least 300 million Android TV and Google TV devices, and well over 1 billion Smart TVs in total—these devices represent massive, low-hanging fruit for bad actors.

Looking ahead a few years, the threat compounds. An AI worm wouldn't necessarily consist of just a single model, and if models eventually become capable of self-improvement, they could theoretically evolve across these distributed IoT clusters.

Detection and Mitigation

Despite the concerning trajectory, Anthropic outlines several practical mitigations and detection opportunities:

• ISP-Level Network Signatures: Weight-based replicators multiplying across IoT machines at scale leave a massive network footprint. Transferring multi-gigabyte AI models from one infected device to another creates traffic anomalies that are highly visible to ISP monitoring systems.
• Regulatory Baseline Security: Legislation—such as the UK's Product Security and Telecommunications Infrastructure (PSTI) regime, which bans universal default passwords and enforces minimum security standards—will help harden these consumer endpoints at the source.
• Core Security Fundamentals: Secure-by-default device design, strong authentication, timely patching, network monitoring, and improved visibility of IoT assets remain our best defence.

The Double-Edged Sword of Early Disclosure

Because this is currently a working proof of concept rather than an active wild threat, it represents an emerging risk for the future rather than an immediate crisis today. By highlighting this risk now, Anthropic arguably gives threat actors a heads-up on how to architect self-replicating distributed worms. On balance, however, publishing this research is vital to expedite defenders' detections.

Looking Ahead

The real significance of Anthropic's research isn't that we have suddenly arrived at self-replicating AI worms, but that we can now see a plausible path to them. While today's demonstrations are slow, constrained, and far from the fully autonomous malware often imagined in science fiction, they highlight how increasingly capable models could eventually leverage billions of poorly secured IoT devices as a distributed computing platform.

Much like Mirai changed how we viewed vulnerable connected devices, future threats may combine traditional malware techniques with AI-driven adaptability—allowing them to understand unfamiliar systems, make decisions, and propagate with less human direction.

Whether or not Anthropic's predictions materialise on the timelines suggested, the research serves as an important reminder: AI is likely to become a force multiplier for both defenders and attackers, and the security decisions we make today will determine which side benefits most tomorrow.