On 12 October, researchers at Anthropic published a report suggesting that small artificial intelligence (AI) models may be only months away from copying themselves across cheap Internet of Things (IoT) devices, such as smart ovens and off-brand Android TV boxes, without needing a data centre. Outlets around the world picked it up, and mainstream media followed suit, as for example, in the recent Philenews article.

Yet, beneath the headlines sits a useful lesson about a term that rarely reaches the news: the Internet of Things (IoT).

What the research actually says

The experiments tested whether AI models could find vulnerable devices, copy themselves onto them and keep spreading without human help. Small models can already manage many of the individual steps, but they still make mistakes when chaining them together from start to finish.

The caveats matter; the tests were deliberately simplified and the target devices had no password protection on the access point being used, which the researchers acknowledge makes the result an upper bound. Any spread would be slow, with a doubling time measured in days and the report states plainly that no fully rogue replicator exists yet.

Not all Internet of Things is the same

In simple terms, the Internet of Things refers to fitting everyday physical objects with sensors and a network connection, so that they can report what is happening, via the Internet and, increasingly, respond to it. Within that definition sits a very wide range.

The devices in the research are at the cheap end of the consumer electronics market: built to a price, typically poorly defended and rarely watched by anyone once they are plugged in.

Professional IoT is a different world. Think of the CO2 and temperature sensors in a school or office, the pressure and flow sensors across a water network or the smart meters and inverters in a community energy scheme. In a well-run deployment:

• someone is responsible for every device, and knows what is installed, where and why;
• software is kept up to date, and devices that cannot be updated are replaced or isolated;
• building and network systems are kept apart from visitor WiFi and everyday office equipment;
• the data is actively used, so unusual behaviour is more likely to be noticed.

None of the above, however, implies or makes professional systems immune. Industrial systems have been compromised too, usually through similar weak spots of default credentials and neglected updates. The difference is not that professional IoT is magically safe; it is that it is managed.

Where this meets PHOEBE’s work

This managed, data-driven kind of IoT is what PHOEBE works with: connected sensors and control systems in smart buildings, smart water systems and energy systems. In WATERVERSE, which the European Commission named a success story in December 2024 with pilots in six countries, including one in Cyprus, reported a potential 15% cut in water losses and 10% drop in electricity costs from optimised pump scheduling. In ANTS, a self-learning heating, ventilation and air conditioning system uses forecasting and multi-objective optimisation to decide, in real time, how to keep a building comfortable at the lowest energy cost.

Systems like these only work if the data can be trusted and that shapes how they are run. Every sensor has a defined job, an owner and an expected pattern of behaviour and a departure from that pattern is far easier to spot when someone is already looking at the data.

The bigger picture

Europe is about to connect a great deal more. The European Commission’s forthcoming action plan on digitalising the water sector, names large-scale deployment of IoT as one of its pillars alongside AI and Earth observation. At the same time, the rules for connected products are tightening: since 11 September 2026, the EU Cyber Resilience Act has required manufacturers to report actively exploited vulnerabilities and severe incidents, with most of its other obligations applying from December 2027.

AI will still stay in the headlines... for now. IoT, however, is what gives AI something to sense and control in the physical world, in homes, buildings and networks and the more of it we deploy, the more it matters that it is built, maintained and watched properly.

So, could a smart oven host a rogue AI? One day, a poorly defended one might. The more useful question is who is looking after the connected devices around us and the answer is often what separates a gadget from (industrial) infrastructure.

References

1.           Anthropic (2026) AI models may be capable of self-replicating without access to a datacenter. Frontier Red Team, 12 October. Available at: https://www.anthropic.com/research/self-replicating-ai.

2.           CNBC (2026) Anthropic warns AI models could self-replicate across home devices. 13 October. Available at: https://www.cnbc.com/2026/10/13/anthropic-ai-models-self-replication-smart-devices.html.

3.           Al Jazeera (2026) AI could self-replicate on home devices within ‘months’, Anthropic says. 13 October. Available at: https://www.aljazeera.com/economy/2026/10/13/ai-could-self-replicate-on-home-devices-within-months-anthropic-says.

4.           BleepingComputer (2026) Anthropic warns self-replicating AI could spread to your smart devices. October. Available at: https://www.bleepingcomputer.com/news/security/anthropic-warns-self-replicating-ai-could-spread-to-your-smart-devices/.

5.           FASI (2026) Digital Action Plan for the Water Sector: Brussels seeks feedback. 28 May. Available at: https://fasi.eu/en/articles/news/30266-digital-action-plan-for-the-water-sector-brussels-seeks-feedback.html.

6.           Enlit Europe (2026) Digitalisation of Europe’s water sector gathers pace. Available at: https://www.enlit.world/library/digitalisation-of-europes-water-sector-gathers-pace.

7.           Alston & Bird (2026) Connected Devices and Software: New EU Cyber Incident Reporting Rules Take Effect. Privacy, Cyber & Data Strategy Advisory, 11 September. Available at: https://www.alston.com/en/insights/publications/2026/09/eu-cyber-incident-reporting-rules-take-effect.