Small AI Models and Connected Devices: Real Risks, Limits, and How to Stay Safe

An Anthropic study on small AI models and connected devices prompted headlines about systems that could multiply across the internet and occupy household appliances. The possibility deserves attention, but describing it as an autonomous and imminent threat oversimplifies what the researchers actually demonstrated.

The study examines whether future lightweight models could become part of a new generation of computer worms. In that scenario, artificial intelligence would help malware identify different machines, configure its execution, and adapt its strategy. However, the experiments did not produce a runaway AI or a complete worm spreading through real household devices.

What did Anthropic investigate?

Anthropic’s Frontier Red Team studied what is known as autonomous replication and adaptation. The concept describes a system capable of installing itself on new machines, running a model, and continuing to spread without a person manually directing every step.

In cybersecurity, a worm is a program that copies itself from one computer to another. Anthropic’s proposed difference is that an AI model could help the worm interpret unfamiliar environments, modify commands, and learn from previous attempts.

The researchers divided the process into four stages:

1. Finding devices that could become targets.
2. Obtaining access and transferring the required components.
3. Configuring the system to run an AI model.
4. Continuing propagation from the new machine.

The work focused mainly on the third stage: testing whether models could prepare different devices to run inference. Initial compromise was not the main subject of the experiment and was deliberately simplified.

What the models accomplished during testing

A nine-billion-parameter model successfully configured inference on eight of the nine hardware types evaluated. The researchers also distributed a larger model across 15 inexpensive Android TV boxes with limited resources.

In another test, GLM-5.2 coordinated the propagation of Llama 3.1 8B across an isolated network of eight emulated nodes. It reached all eight nodes in four out of five trials and seven nodes in the remaining trial.

The result shows that advanced models can already organize several actions in a replication chain. It also indicates that some small models can configure inference software on hardware they have not previously encountered.

What the study did not demonstrate

The findings must be interpreted within their limits. The research did not demonstrate:

• An AI system currently spreading across the internet.
• A model deciding on its own to infect devices.
• A complete autonomous worm operating on real household appliances.
• The ability to compromise any device without credentials, permissions, or security flaws.
• Fast, invisible, or unstoppable propagation.
• That this capability will necessarily appear on a specific date.

The experimental network exposed an unauthenticated ADB port. This made access easier and turned the result into an upper-bound estimate of what could be achieved under real-world conditions. Some commercial devices do have poor configurations, but not all are equally vulnerable.

Anthropic also acknowledges that two essential requirements do not currently overlap: the intelligence level required to complete the whole chain and a model size small enough to run on the evaluated devices.

Why the timeline is not a certainty

Anthropic projected that a small model could reach the required level if capabilities continue improving at the historical rate. However, the estimate uses a general capability index as a proxy for the specific ability to replicate.

A statistical trend does not guarantee that every technical barrier will be solved at the same time. New models may require different architectures, libraries, memory, or instructions. An estimated date should therefore be communicated as a planning scenario, not as a calendar for an inevitable event.

“It may become technically possible” does not mean “it is happening,” “it will happen on that date,” or “it cannot be stopped.”

Would artificial intelligence have an instinct to survive?

There is no need to attribute consciousness, desire, or self-preservation to a model to understand the risk. A system can carry out propagation instructions because it was programmed, trained, or configured to pursue that objective.

A malicious scenario would initially require a program that:

• Includes or downloads model weights.
• Provides the model with tools and network access.
• Defines finding other machines as an objective.
• Exploits vulnerabilities or weak configurations.
• Transfers the code required to continue the process.

AI would not spontaneously appear inside a television or smart oven. The danger would arise when a person or group incorporates it into a malware operation, or when a system with excessive permissions is compromised.

How would this differ from a traditional computer worm?

During Anthropic’s tests, a model that inherited notes from previous attempts improved its initial success rate from 45% to between 61% and 84%. This represents operational improvement through accumulated information, not biological evolution or consciousness.

Why connected devices are potential targets

Televisions, cameras, doorbells, media players, plugs, routers, and smart appliances may remain connected for years. Unlike computers, many receive few updates and operate with settings the user never reviews.

Low-cost devices or products from little-known manufacturers may introduce additional problems:

• Default or easily discovered passwords.
• Exposed administration ports.
• Modified Android systems without regular patches.
• Control applications that stop receiving support.
• Remote features enabled even when they are unnecessary.
• Limited information about the security-update period.

Conventional botnets already exploit these weaknesses. AI could make exploitation more adaptable, but it does not create poor security from nothing.

Realistic risks for homes and organizations

If a small agent were incorporated into malware, its effects would depend on its objectives and access. Plausible risks include:

• Adding devices to a network used for coordinated attacks.
• Consuming energy, memory, processing power, and bandwidth without authorization.
• Searching for credentials, keys, or information accessible from the machine.
• Using compromised cameras, microphones, or sensors.
• Exploring other devices connected to the same network.
• Adapting to small differences between systems.
• Persisting after incomplete removal attempts.

In a business, a vulnerable television, camera, or video-conferencing device could also become an entry point to more important systems if they share the same network.

Factors that support detection and defense

Anthropic’s own results reveal relevant limitations. On the evaluated hardware, configuring execution could take between 28 and 150 hours. The distributed model operated at approximately 0.3 tokens per second, far below the speed of a commercial service.

Transferring multi-gigabyte models and maintaining continuous device-to-device communication would also produce visible signals. Faster propagation would generate more traffic and be less discreet. Internet providers and security teams could detect:

• Unusually large downloads to devices that normally consume little data.
• Repeated connections to multiple addresses.
• Sustained communication between devices that normally do not interact.
• Port scanning and other target-discovery patterns.

The absence of a central point would make complete removal harder, but it would not make every infected device invisible or unrecoverable.

How to protect connected devices

1. Change default passwords

Every device and the router’s administration panel should use unique credentials. If a product does not allow a generic password to be changed, it creates an unnecessary risk.

2. Enable automatic updates

Updates fix known vulnerabilities. It is also useful to check firmware manually when a device does not clearly report whether it is current.

3. Check the support period before buying

A cheap device can become costly if it stops receiving patches shortly after purchase. Prefer manufacturers that publish how long they will provide security updates.

4. Disable unused remote access

If you do not need to control the device away from home, turn that feature off. Debugging services, remote administration, and automatic connectivity features should also be disabled when unnecessary.

5. Enable two-step verification

When the manufacturer’s app or account supports it, an additional verification step reduces the risk of access even if a password is exposed.

6. Separate smart devices

A guest network or independent segment can prevent a compromised television, camera, or plug from having direct access to work computers and files.

7. Update and secure the router

The router connects every device to the internet. Change its administrative credentials, install updates, and regularly review the list of connected equipment.

8. Retire unsupported products

If a product no longer receives updates and cannot operate without internet access, consider replacing it. When possible, disconnecting it may extend its useful life without leaving it exposed.

9. Watch for behavioral changes

Frequent restarts, overheating, poor performance, high data use, or unknown connections do not confirm an infection, but they justify reviewing the settings and contacting the manufacturer.

10. Reset a compromised device

If there are reasonable signs of compromise, disconnect it, consult the official instructions, install available firmware, and perform a factory reset. Then change related credentials before reconnecting it.

Responsibility does not belong only to users

It is unreasonable to place the entire security burden on people buying household products. Manufacturers should prevent shared default passwords, provide updates, disclose support periods, and offer clear mechanisms for reporting vulnerabilities.

Internet providers can detect anomalous behavior and notify affected customers. Regulators can establish minimum requirements so devices do not enter the market with predictable weaknesses.

Anthropic cites infection removal through provider notifications and network quarantine as a useful precedent. It also notes that raising basic security requirements would reduce the pool of machines available to a potential botnet.

Conclusion

Anthropic’s research does not announce that artificial intelligence is about to take over household appliances. It shows that the capabilities required to combine small models with propagation mechanisms are advancing and that longstanding weaknesses in Internet of Things security may become more important.

The risk should be studied before a widespread threat exists. At the same time, a preventive evaluation should not become an apocalyptic certainty. Capability, size, speed, and access barriers remain, along with signals that could support detection.

For users, the recommendation is straightforward: do not panic, but do not connect devices without checking who maintains them, how they are updated, and what access they have to the network. Everyday security remains the most useful defense against current malware and against future threats that may incorporate artificial intelligence. For another example of emerging digital threats, read our analysis of AI phishing and fraudulent links.