AI security often assumes that someone controls the infrastructure: a provider can suspend access, revoke credentials or stop a deployment. But what happens when an AI system runs across devices that no single organisation controls?

Research published by Anthropic on October 12 explores that possibility. Its researchers suggest that small models could become capable of autonomous replication across poorly secured connected devices within months. That is a forecast, rather than evidence of an uncontrolled AI system already spreading online.

What the experiments actually show

Anthropic demonstrated a model running across 15 inexpensive Android TV boxes. Smaller models could also configure AI inference on unfamiliar hardware, although reliably connecting all the replication steps remained a challenge.

The limitations matter. The network replication evaluation deliberately simplified the intrusion stage, and larger models supplied capabilities that smaller models do not yet reliably match. The end-of-2026 estimate depends on continued progress, measured through a general capability benchmark.

Adaptation could change the threat

The proposed difference from conventional malware is adaptability: an AI agent could troubleshoot unfamiliar environments instead of depending entirely on predefined instructions. Anthropic also expects early IoT replicators to spread slowly, potentially taking days, while generating traffic that defenders could detect. Distributed operation would complicate containment, but would not make intervention impossible.

For businesses, the useful question is how that possibility changes the way systems should be designed and operated.

A meeting-room display, camera or connected appliance deserves attention because of what it can reach. If a compromised device can communicate freely with internal services, weak protection at the edge can become a wider operational problem.

Control needs to extend beyond the model

Our engineering takeaway is that AI containment should be treated as a system requirement.

Teams should be able to answer practical questions:

Which devices and agents can access critical services?
What credentials can they use, and who can revoke them?
Can unexpected workloads or network activity be investigated?
Can a compromised component be isolated while essential operations continue?

These questions connect AI governance with everyday architecture, infrastructure management and incident response. Model safeguards are one layer; permissions, network boundaries and operational visibility provide additional control.

The same thinking applies to authorised AI agents. An agent introduced to support development or automate a workflow needs explicit limits on where it can execute, which resources it can provision and what changes require approval.

At Control F5 Software, we see this as an engineering responsibility: useful automation needs clear boundaries and a practical recovery path. As agents gain more capability, organisations need equally concrete ways to observe their actions, interrupt unwanted behaviour and restore reliable operations.

Source