Key Insights:
- Anthropic AI warning says small models may soon replicate across low-cost IoT hardware.
- David Sacks says controlled tests do not support the broadest threat claims.
- Only GLM-5.2 completed end-to-end replication in Anthropic’s simplified trial.
David Sacks has challenged Anthropic’s AI warning that small models could spread across inexpensive, connected hardware. Anthropic said compact systems may gain autonomous replication abilities within months. Its researchers tested models on Android TV boxes and simulated cloud devices.
Sacks questioned whether those controlled results justify the report’s broader threat. The evidence shows meaningful progress, but it does not show an uncontrolled AI worm operating online. That distinction now drives a broader debate over self-replicating AI, cybersecurity, and regulation.
Anthropic’s report forecasts future risk based on current capability trends, not a confirmed attack. The company published the research on October 12.
Anthropic AI Warning Focuses on Small Model Replication
Anthropic’s Frontier Red Team examined whether compact models could copy and launch themselves on unfamiliar hardware. Researchers William Zhou and Daniel Freeman divided autonomous replication into several steps. These included finding targets, gaining access, setting up inference, and continuing propagation.
The Anthropic AI warning centers on models with no central server or shutdown point. Researchers said these systems might spread slowly, with doubling measured in days. Yet they could adapt to unfamiliar environments better than conventional malware.
One experiment distributed Gemma4-26B-A4B across 15 off-brand Android TV boxes. Each box cost about $55 and carried part of the model. Together, the devices produced 0.39 tokens per second. The low speed made the setup impractical for normal use. Still, it proved that cheap IoT devices could collectively host a capable model.
David Sacks Questions the Anthropic AI Warning Evidence
Sacks framed the report as another alarm from what he called the “Anthropic Fear Factory.” He asked whether small models truly pose the danger the headline suggests. His response focused on the distance between the experiment and a real attack.
That gap is visible in Anthropic’s own methodology. The researchers used a firewalled network of eight simulated Android nodes. They also left an unauthenticated Android debugging port open. This made access intentionally easy and removed a major real-world barrier.
The worm’s controlling model ran on a separate inference server. The simulated nodes could not directly host the larger system. Anthropic also acknowledged that the design represented an upper bound on real-world success. Those limits support Sacks’ skepticism, although they do not erase the security questions.
The Anthropic AI warning therefore rests partly on extrapolation. Its end-2026 estimate uses historical gains in a general capability index. Anthropic described that timing as rough because the index only approximates replication skills.
What the IoT Tests Show About Self-Replicating AI
Qwen3.5-9B successfully established inference on eight of nine hardware types. Models below 30 billion parameters also completed many separate replication tasks. However, they often failed when required to reliably combine every step.
GLM-5.2 was the only tested open-weight model to finish the simplified end-to-end process. It reached all eight nodes in four of five trials. It reached seven nodes in the remaining trial. Anthropic said this suggests smaller models may acquire comparable abilities as performance improves.
The self-replicating AI risk remains theoretical outside controlled tests. Anthropic said no fully autonomous rogue replicator currently exists. However, insecure IoT devices already offer attackers a large target base. Faster models and expanding edge hardware could lower the technical barrier.
The report proposed network monitoring, ISP quarantines, better device defaults, and stronger manufacturer security. Large model transfers would create traffic patterns that defenders could detect. Removing default passwords could also shrink the pool of vulnerable hardware. Anthropic noted that default IoT passwords are already non-compliant in UK markets.
