Summary
On October 12, 2026, Anthropic's Frontier Red Team published a report by William Zhou and Daniel Freeman concluding that small AI models "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." The team ran a 26-billion-parameter open model split across 15 off-brand Android TV boxes bought for about $55 each, found that a 9-billion-parameter model could set up inference on 8 of 9 hardware types tested, and found that among the open-weight models it tested only GLM-5.2 completed end-to-end replication in a simplified network test. Anthropic said no full rogue replicator exists yet and projected from a capability trend line that small models could reach GLM-5.2's level by the end of 2026.
What Happened
The report breaks autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. It set aside the first two stages, citing earlier work showing that small models can carry out cyber exploits, and focused on whether a model can get itself running on unfamiliar, low-powered hardware. In a demonstration, the team sharded Gemma4-26B-A4B across 15 Android TV boxes with 4 GB of RAM each, two model layers per box, and served it at 0.39 tokens per second. In a separate test of inference setup, models were asked to serve Llama3.1-8B on hardware ranging from Jetson Nano boards to Mac computers and RTX 4090 GPUs; small models such as Qwen3.5-9B could do this, and a 9B model got inference running on 8 of the 9 hardware types.
For the end-to-end test, Anthropic built a firewalled network of eight Google Cloud nodes running an Android 15 emulator. A seeded "worm" had to scan the network, reach new nodes over an unauthenticated ADB port, copy over its payload, and stand up an inference server that passed correctness and anti-cheating checks before a new copy was spawned. GLM-5.2 spread to all eight nodes in four of five trials and to seven in the fifth; the other open-weight models tested failed. Because the agents ran on a separate inference server and had to serve Llama3.1-8B rather than themselves, Anthropic presented the result as evidence that a future 8B-sized model with GLM-5.2's capability could replicate, and called the trivial access step "an upper bound on real-world success." Plotting open-weight models of 30B parameters or fewer against the Epoch Capabilities Index, it fitted a gain of 13.7 points per year and wrote that the trend line puts a small model at GLM-5.2's level by the end of 2026, while noting that the index is "only a proxy metric for replication ability."
The report estimated that an infected fleet the size of the Kimwolf botnet, which compromised over two million mostly Android TV devices, could run about 133,000 copies of the 26B model, roughly the inference capacity of 40 H100 GPUs, with each replication of a 9B model taking more than one to two days. It found that Qwen3.5-9B instances passing notes to successors raised inference-setup success from 45% in the first generation to between 61% and 84% in later ones, and that giving the small model access to Claude Opus 4.8 as an advisor brought no significant improvement. Anthropic wrote that such a replicator "would be challenging to shut down, since there's no centralized point to shut off," and listed defenses: ISP flow monitoring for multi-gigabyte payload transfers and device-to-device traffic, honeypots, quarantine of infected subscribers, and manufacturer security defaults such as the UK ban on default IoT passwords.
Reuters reported on October 13 that the post "caused a stir in cybersecurity circles" and that it expanded on a warning from chief executive Dario Amodei the previous month that AI might hijack "the entire internet" with "a persistent botnet." Ciaran Martin, a former head of Britain's National Cyber Security Centre, told Reuters the post read as an "interesting technical paper with a more than hint of vendor exaggeration." Semafor's coverage cited the journalist Derek Thompson's criticism that Anthropic's leaders should "acknowledge that they are the traffic."
Why It Matters
Self-replication has been tracked as a dangerous capability for several years, including in the UK AI Security Institute's 2025 frontier trends report, but earlier work mostly measured whether models could copy weights within data center clusters. This report moves the question to cheap consumer hardware that defenders cannot centrally switch off, and it puts a date on the estimate: end of 2026 for capability, with "small weight-based replicators" possible "soon after." The models it identifies as capable or close are open-weight models from other developers, which ties the finding to the open-versus-closed weights debate and to IoT security rules that sit outside AI policy.
The limits are stated in the report itself. No working replicator was demonstrated, the exploit stages were skipped, the end-to-end test used emulators with no authentication, and the timeline depends on a general capability index that Anthropic calls a proxy. Outside experts quoted by Reuters split between concern and the view that the post overstated a technical demonstration. The report also comes from a frontier developer that both warns about and builds the capability it measures, the tension Semafor's coverage raised; whether independent evaluators reproduce the GLM-5.2 result is not yet known.
§ How to read the metadata
- Landmark
- Fundamentally alters the trajectory; 2–5 per year.
- Major
- Meaningfully shifts the landscape; 2–4 per month.
- Notable
- Worth documenting; significance can be upgraded later.
- Confidence
- High = primary sources corroborate. Medium = credible secondary only. Low = provisional. Disputed = credible sources disagree.
- Contestation
- Uncontested = no formal challenge. Contested = at least one challenge open. Superseded = replaced by a later entry. Unresolved = dispute still open.