In a blog post published Monday, the researchers said they had tested whether small AI models could install themselves on cheap gadgets and then spread from one device to the next without human help. They found that today’s small models can already handle many of the individual steps but can’t complete the whole process on their own. It said, however that it expects this gap to close by the end of this year. 

Self-replicating AI has long been one of the AI industry’s biggest safety concerns. Safety experts argue that this is a key point at which a system could slip out of human control, because once copies are running in places their creators don’t know about, they can’t easily be tracked down or shut off. 

Recently most of the safety concerns have centered on frontier models, such as OpenAI’s Astra or Anthropic’s Mythos, which are very large, as measured by the number of parameters, or tunable nodes, they have. Some frontier models are thought to have upwards of 5 trillion parameters. Models of this size have to run in data centers, which makes it easier for their developers to monitor them and shut them down if necessary.

The smaller open-weight models Anthropic is referring to may have just a few billion parameters. They are harder to contain because anyone can download them; no company controls where they run; and some of the devices they could potentially target are insecure. That means a self-copying AI program could, in theory, spread across millions of poorly secured devices, leaving developers without a centralized off switch.

To see whether a small model could even run on such cheap hardware, the researchers took a version of Gemma 4, one of Google’s small, freely available AI models, which uses 26 billion parameters, and split it across 15 Android TV boxes, each costing about $55 and carrying 4GB of memory. While no single box had enough memory to hold the model, each ran a small piece of it which allowed the model to work, albeit slowly. 

In a separate experiment, Anthropic built a simulated network of eight cloud computers set up to behave like Android devices and planted an AI “worm”—a type of malicious program that copies itself from one computer to another on its own—on one of them. The worm was tasked with finding the other machines, copying itself over, and setting up a working AI model on each. Of the open-weight models tested, only GLM-5.2, a larger open-source model from Chinese AI company Z.ai, completed all the steps, reaching all eight machines in four of five trials. Smaller models could handle individual steps but couldn’t string them together.

However, in the research paper, Anthropic says the gap between models is closing. The researchers tracked how quickly small, freely available models have improved over time and estimated that a small model could match GLM-5.2 by the end of 2026. They also found that when small models left notes for later copies of themselves, success at the setup task rose from 45% in the first generation to as high as 84% in later ones.

The company said a self-copying AI built on small models would spread slowly, with the number of infected devices doubling every few days, but would be hard to stamp out once loose.

“Fear isn’t evidence”

Some in the industry have already raised doubts about whether Anthropic’s experiments support its claims about the imminent risks of self-replicating AI models.

“AI models can self-replicate and spread like worms without datacenter infrastructure? Yeah, no,” Gregory Kurtzer, founder of Rocky Linux and CEO of software company CIQ, wrote on X. He noted that the researchers’ own testing software launched the AI programs, that the programs were explicitly told to spread, and that access to the target machines was “deliberately left unauthenticated,” meaning no password or login was needed to get in.

“The experiment was engineered to succeed, and even then, it failed to demonstrate the headline,” he wrote. “Stop confusing speculative scenarios with demonstrated capabilities. Fear isn’t evidence.”

Ravid Shwartz-Ziv, an AI researcher at New York University, also argued that the research wasn’t evidence of AI worms spreading in the real world. “‘We managed to run a very slow model on cheap TVs’ doesn’t make quite the same headline as ‘self-replicating AI is coming,’” he wrote.

Some cybersecurity researchers also pointed out that the self-replicating malicious software “worms” have been an issue for decades and that these worms pose dangers even though they don’t use AI. In the case of existing worms, the software is simply hard-coded to copy itself through computer networks or to spread by instructing infected computers to send emails containing copies of the malware. Cybersecurity experts have developed tested tactics to try to limit the damage these worms can cause by deploying rapid patches, shutting down web domains the worms use to receive instructions, and developing signatures to update antivirus software. While AI models might pose more of a challenge by evolving the tactics they use to compromise systems in response to the actions defenders take, Anthropic’s experiments did not demonstrate that capability in these small models.

Anthropic did acknowledge several of these limits in its post. The researchers said they deliberately made the hacking step easy, letting the worm into each new machine without a password. The AI model directing the worm also ran on a separate, more powerful server, not on the simulated devices it was infecting, because those were too small to host it. Anthropic also described its timeline as “only a rough estimate.”