Anthropic Flags a New Worry: AI Models Small Enough to Infect Your Smart Fridge

Anthropic, the company behind the Claude models, is sounding an alarm about a threat that doesn't exist yet but might soon: malware powered by small AI models that can copy itself across internet-connected household gadgets, including smart fridges and robot vacuums, and keep running even after security teams try to kill it.

In a new blog post, the company said that within the next year, lightweight AI models could gain the ability to self-replicate autonomously across a wide range of Internet-of-Things (IoT) hardware. Pushed to its logical endpoint, that capability could give rise to a new category of computer worm, meaning malicious code that spreads on its own without a person clicking a bad link or opening an infected file, and that can adapt itself to devices it has never encountered before.

Anthropic tested the idea directly rather than just speculating. The company says its experiment ran into real obstacles standing in the way of building a working replicator, which is why it frames the overall finding as tempered rather than alarmist. Still, the results were enough to prompt the public warning.

Why this is different from ordinary malware

Traditional computer worms are built for specific hardware and software. That makes them brittle in a useful way: write a patch for the vulnerability they exploit, update the firmware, and the worm stops spreading. Anthropic's concern is that an AI-driven version wouldn't behave that predictably.

According to the company's blog post, a self-replicating system built around small AI models "would be challenging to shut down, since there's no centralized point to shut off — though it may be slow (with a doubling time of days)." The post adds a second detail that matters just as much: "Unlike non-AI malware, it could also figure out unfamiliar devices on its own."

That second point is the real shift. Ordinary malware has to be told in advance exactly what kind of device it's attacking. A model with enough general reasoning ability could instead examine whatever hardware it lands on and work out how to run there, the way a person might improvise with unfamiliar tools. No single server to seize, no single code strain to blacklist, just a model that keeps finding new ways to copy itself.

How Anthropic tested it

This is a live concern now because AI models have gotten dramatically more efficient to run. Frontier models, the large, capable systems companies like Anthropic build, still need serious computing hardware. But a newer generation of smaller, open-weight models, meaning models whose underlying parameters are published for anyone to download and run, can operate on hardware that's a tiny fraction as powerful.

Anthropic's researchers tested this by deploying small open-weight models on real and simulated versions of cheap, off-brand Android TV boxes and other IoT hardware. To squeeze the models onto such weak devices, the team used quantization, a technique that represents a model's internal parameters with fewer bits of data, shrinking its memory footprint. They also split the computational workload into pieces, called shards, distributed across multiple devices working in tandem.

The results were notable. A model called Gemma4-26B-A4B achieved inference, meaning its weights loaded successfully and it could generate output, using just 15 of the low-cost boxes, each equipped with only 4GB of memory. Separately, a model called Qwen3.5-9B was able to configure other large language models to run across eight of nine different hardware types it was tested against.

That last detail is the part worth sitting with. Rather than being pre-programmed for each device, the model used its own learned knowledge to figure out, on the fly, how to adapt itself to hardware it hadn't been specifically built for. That adaptive, device-agnostic behavior is what separates this scenario from the malware defenders already know how to fight.

A warning, not a forecast

Anthropic frames all of this as an early signal rather than a prediction that such a worm is imminent. The company's own experiment hit genuine technical hurdles trying to get a working replicator off the ground, which is part of why it's describing the risk as something to watch rather than something already loose in the wild.

Still, the trajectory was clear enough that Anthropic decided it was worth publishing. IoT devices tend to run on a patchwork of cheap, loosely secured hardware, the kind of generic, off-brand gear used in the company's own test. Pairing that with AI models that keep shrinking in size and keep getting better at improvising could eventually hand attackers malware that doesn't need a vulnerability tailored to each target, just a foothold and the ability to reason its way into the next one.

For now, the gap between achieving inference on a stack of cheap TV boxes in a lab and a self-propagating worm loose on the internet is still real. But Anthropic's message is that the gap is closing faster than the industry might expect, and that the usual playbook for killing a worm, find the hardcoded weakness and patch it, may not work on something that can think its way around a patch in the first place.