Anthropic team: small AI models may self-replicate on smart devices within months

The latest:

Small AI models could be months away from replicating themselves across cheap internet-connected devices without any datacenter, according to experiments published by Anthropic’s Frontier Red Team. Researchers William Zhou and Daniel Freeman reported running Gemma4-26B-A4B distributed across 15 off-brand Android TV boxes at 0.39 tokens per second. They wrote that such a replicator would be hard to shut down because there is no centralized point to switch off.

Details:

• The demo: The team bought 15 Android TV boxes at roughly $55 each, networked them, and split Gemma4-26B-A4B across them under pipeline parallelism, with each box holding two of the model’s layers. Boxes in that price class typically ship with 1 to 4 gigabytes of RAM, the researchers said.
• The inference test: Across nine hardware types ranging from Jetson Nanos to Mac PCs and RTX 4090s, a 9B model got inference running on 8 of them, according to the report. Stronger models such as GLM-5.2 were described as both more reliable and faster at serving tokens, which would speed replication.
• The replication run: Researchers built a firewalled network of 8 Google Cloud nodes running an Android emulator, seeded one with the worm, and measured whether it could hop between machines over an unauthenticated port. Of the open-weight models tested, only GLM-5.2 replicated end to end, reaching 8 of 8 nodes in 4 of 5 trials.
• The caveat: The evaluation deliberately kept the hacking step trivial, with no authentication required, which the authors said makes the result an upper bound on real-world success. They noted the Mirai botnet spread by cycling through default manufacturer passwords, so actual device security may not be far tougher.
• The timeline estimate: Plotting open-weight models of 30B parameters or fewer against the Epoch Capabilities Index, the researchers measured a gain of 13.7 index points per year. Treating GLM-5.2 as the capability floor, the trend puts a small model at that level by the end of 2026 — an estimate they called rough.
• The speed problem: Replication would be slow. The team estimated 71 to 150 hours for a full inference setup with the 26B model and 28 to 51 hours with Qwen3.5-9B. Scaled to a fleet the size of the Kimwolf botnet, which Synthient reported infected over 2 million devices, the swarm would hold at most about 40 H100s-worth of compute.
• Learning on the job: Across six generations of Qwen3.5-9B, each inheriting written notes from its predecessor, setup success rose from 45% in the first generation to between 61% and 84% later. The authors called this Lamarckian evolution, and said it is one reason an AI worm could outperform traditional malware.
• Asking for help fails: Giving Qwen3.5-9B access to a frontier advisor model produced no measurable gain, whether offered as a tool call or volunteered when the model was stuck. The researchers found small models tend not to know the right questions to ask, even after reinforcement training on advisor use.
• Phishing weakness: On Meta’s CyberSecEval 3 spear-phishing benchmark, small models scored between very poor and poor once normalized to human raters. The authors expect social engineering to remain the domain of larger frontier models, reversing the usual human-hacker tradeoff.
• Defenses: Driving each device’s infection rate below 1 is the goal, the report said. Multi-gigabyte weight transfers and sustained device-to-device traffic would leave a network signature. ISP quarantine cleared 92% of Mirai infections within 14 days versus 74% without notification, and the UK has made default IoT passwords non-compliant.

Background:

Autonomous replication and adaptation describes a model deploying and spreading itself without human control. Prior work showed AI agents copying model weights across GPU clusters. This study instead targets cheap connected devices, where the model’s weights become the malware payload itself.

Between the lines:

The researchers frame the threat as two lines that have not yet crossed: a capability floor a worm must clear, and a size ceiling it must fit under to run on the hardware it attacks. GLM-5.2 sits above the floor; the 9B and 26B models sit under the ceiling. Their projection is that falling minimum model size and rising capability close that gap — making the question timing, not feasibility.

What’s next

The authors’ stated marker is whether a sub-30B open-weight model reaches GLM-5.2’s capability level by the end of 2026. Also worth tracking: regulatory moves on default device passwords beyond the UK, and any first weight-carrying botnet observed in the wild.