Could AI models self-replicate across consumer IoT devices?

Anthropic's Frontier Red Team reports that "small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." They demonstrate the concept by running Gemma4-26B-A4B sharded across 15 off-brand Android TV boxes (about $55 each, 4GB RAM apiece) at 0.39 tokens per second, and report that a 9B model "got inference running on 8 of the 9 hardware types" tested, including Jetson Nanos, Mac PCs, and RTX 4090s. The team frames this as sharpening a longstanding concern, autonomous replication and adaptation (ARA): a "weight-based replicator" could carry its model weights as part of the malware payload and run inference directly on compromised hardware, with "no centralized point to shut off."

The mechanism is distributed inference, not raw compute. A model too large for one device is split into shards across many weak machines running in pipeline parallelism, the way Petals already does for research use. The team points to Kimwolf, a real IoT botnet that infected over two million off-brand Android TVs, as the representative threat substrate — devices with 1-4GB RAM, AOSP forks, and no vendor security hardening. At 4-bit quantization, they estimate 4GB boxes can collectively serve a 9B model with four or more machines, or a 26B model with ten or more, which is why they argue datacenter GPUs are "a clear, high-value target" but "aren't strictly necessary."

This extends How does the substrate change which behaviors an optimizer can reach?: the IoT botnet is a new substrate that makes a behavior — self-replication without centralized infrastructure — reachable in a way a datacenter-bound threat model would miss, and its decentralization directly degrades inspectability and interruptibility, since there is "no centralized point to shut off." It also bears on Can safety protocols survive a model actively trying to break them?: a control protocol built around monitoring or interrupting a model inside a datacenter boundary does not obviously transfer to a model distributed across thousands of consumer devices outside that boundary.

The post is a capability demonstration and threat model, not a measured incident — no IoT replicator has been observed in the wild, and the team's own "months away" and "doubling time of days" are projections from a simplified evaluation, not field data. It also does not by itself establish that current models can autonomously identify and compromise IoT targets at scale end to end (see Can weaker models chain individual replication steps together? for the composition gap from the same evaluation). The implication the team draws is that ARA defenses aimed only at datacenter-scale compute will miss a cheaper, harder-to-shut-down replication path through consumer hardware.