Anthropic warns self-replicating AI botnets could hit IoT devices soon

Anthropic published a research report on Monday warning that self-replicating AI botnets could become feasible on Internet of Things hardware within months. The company claims that if smaller artificial intelligence models become smarter, they could spread across vulnerable devices without relying on centralized datacenter infrastructure.

The frontier lab demonstrated that a 9-billion-parameter model successfully configured inference on eight of the nine hardware types it tested. Anthropic stated that such a replicator would be difficult to disable because there is no central point to shut off. This decentralized nature could make the threat more adaptable than conventional botnets like Mirai or Kimwolf.

Experimental Proof of Concept

Researchers distributed an instance of Gemma4-26B-A4B across 15 generic Android set-top streaming boxes. These devices are common targets for traditional botnet malware due to their lax security posture. Once the distributed model was running, it performed inference tasks at a rate of 0.39 tokens per second.

Anthropic clarified that this experiment proved AI models can conduct inference with layers distributed across cheap hardware. However, the company noted that this does not prove the model could self-replicate on its own. To test replication capabilities, the researchers turned to a different model for the next phase of their study.

Replication in Virtual Environments

For the replication test, Anthropic used Z.ai’s GLM 5.2 to propagate a copy of Llama3.1-8B. The propagation occurred across eight Google Cloud instances running an Android 15 emulator within a virtual private cloud. Anthropic reported a high degree of success in these controlled trials.

In four out of five trials, the model successfully spread to all eight nodes. In the remaining trial, it spread to seven of the eight nodes. This suggests that current models have the technical capability to move between devices in a network, provided they can identify and exploit entry points.

What should you do?

Security professionals should monitor for unusual network traffic patterns that indicate distributed processing or lateral movement. Organizations should review their IoT device inventories to identify legacy or generic hardware that may lack security updates. Patching known vulnerabilities in streaming boxes and other consumer electronics remains a critical defense against botnet recruitment.

What to do and how to stay safe: Anthropic

• Audit your network for generic Android set-top boxes and other IoT devices with known lax security configurations.
• Monitor network logs for unusual lateral movement patterns that could indicate distributed model propagation attempts.
• Ensure all consumer electronics are updated to the latest firmware versions available from the manufacturer.
• Segment IoT devices from critical infrastructure to limit the blast radius if a device is compromised.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Can AI models currently self-replicate on real-world IoT devices?

Anthropic’s research shows models can be distributed across hardware, but the replication was demonstrated in controlled cloud environments using emulators, not on live consumer networks.

Which models were used in the Anthropic study?

The study used Gemma4-26B-A4B for distributed inference tests and Z.ai’s GLM 5.2 to propagate Llama3.1-8B across cloud instances.

Why are self-replicating AI botnets considered dangerous?

Anthropic warns that such replicators would be challenging to shut down because they lack a centralized point of failure, potentially making them more adaptable than traditional botnets.