Anthropic warns small models could become AI worms spreading across home devices

Anthropic researchers published a blog post this week with an explicit warning: small language models are "a few months" from acquiring the ability to self-replicate across networks of home devices. The experiments demonstrate initial feasibility, but the gap between what was shown in the lab and the threat described remains wide. Experts who spoke with The Verge agree the idea isn't new — computer worms have existed for decades — but the leap in small-model capabilities makes the scenario more plausible than before.

Until now, the AI safety debate has centered on frontier models such as OpenAI's Astra or Anthropic's own Mythos. Those contain trillions of parameters, the values learned during training, and demand massive compute that confines them to data centers where they can be monitored and, if necessary, shut down. Small models, by contrast, are improving rapidly, run on consumer hardware and are often freely downloadable. That combination creates an entirely different attack vector.

To test whether a model could run across a fleet of weak devices, the researchers split Google's Gemma 4, a 26-billion-parameter model, across 15 Android TV boxes, none of which could run it alone. It worked, albeit very slowly. The next step was to examine whether an AI could perform the steps required for self-replication in such an environment. The researchers built a simulated network that mimics Android devices and released a "worm" powered by a language model — malware that automatically replicates across the network — tasked with locating new machines, copying the model to them and executing it there. The model distributed in the experiment was Meta's Llama 3.1-8B, just 8 billion parameters, separate from the model coordinating the attack.

Of the models tested, only Z.ai's Chinese GLM-5.2 succeeded in spreading across the entire network. Smaller models completed only individual steps. Based on the current rate of improvement, Anthropic researchers estimate small models will match GLM-5.2's capabilities by year-end. The researchers acknowledge openly that they have not demonstrated a "full rogue replicator" and do not know what one would look like; they offer the metaphors of "slow, distributed digital mold" or a "fruit-fly swarm," but argue the findings show "signs of life for AI worms" and call for hardening security on the many devices such a replicating system could exploit.

The Anthropic post does not disclose detailed benchmarks for quantitative comparison, nor does it describe the simulated network architecture or the simulation's limitations. The timeline — "a few months" — is given as a forecast based on extrapolation, not experimental proof. In short: technical feasibility was shown in isolated steps, the full threat remains theoretical, and the call to harden edge devices remains a policy recommendation more than a conclusion drawn directly from the data presented.