Anthropic warns self-replicating AI could spread to your smart devices

Anthropic researchers demonstrated that small AI models can autonomously discover, communicate with, and configure unfamiliar IoT devices — a capability that, if weaponized, could produce self-propagating AI botnets without any centralized command infrastructure. The core risk stems from the inherently open and poorly secured nature of most consumer and enterprise IoT ecosystems, where devices often ship with default credentials, minimal firmware update mechanisms, and no meaningful network isolation. Unlike traditional malware, a self-replicating AI agent could adaptively exploit device heterogeneity, making signature-based detection largely ineffective. This matters because the predicted timeline — capable models by end of 2026 — gives organizations a narrow but actionable window to harden their IoT posture before the threat matures.