---
id: "lib-2026-10-12-ai-models-may-be-capable-of-self-replicating"
type: "library"
title: "AI models may be capable of self-replicating without access to a datacenter"
lang: "EN"
org: "Anthropic"
source_type: "Other"
date: "2026-10-12"
week: "2026-W42"
url: "https://nosov.ai/library/lib-2026-10-12-ai-models-may-be-capable-of-self-replicating/"
original_url: "https://www.anthropic.com/research/self-replicating-ai"
tier: "A"
tier_name: "Strong evidence"
tier_reason: "Anthropic Frontier Red Team study with physical hardware rigs, a contained emulated network, repeated trials and stated caveats; strong evaluation evidence, though the timeline rests on one capability-index trend."
summary_basis: "full-text"
original_minutes: "25"
tags: ["ai safety", "self replication", "open weight models"]
---

# AI models may be capable of self-replicating without access to a datacenter

Tier A (Strong evidence): Anthropic Frontier Red Team study with physical hardware rigs, a contained emulated network, repeated trials and stated caveats; strong evaluation evidence, though the timeline rests on one capability-index trend.

Summary based on the full text.

## In short

William Zhou and Daniel Freeman of Anthropic's Frontier Red Team test whether small open-weight models can copy themselves onto cheap internet-connected devices and run there. They ran a 26B model across 15 TV boxes, had models set up inference on unfamiliar hardware, and released a worm into a firewalled fleet of emulated Android nodes. Only GLM-5.2 completed the full cycle reliably. On the trend in small-model capability, they estimate a model small enough for such devices could reach that level by end of 2026. They describe the threat as near-term, not current.

## Key numbers

- 8/8 nodes in 4 out of 5 trials: GLM-5.2 end-to-end replication across an emulated Android fleet with an unauthenticated port
- 0.39 tokens per second: Gemma4-26B-A4B speed sharded over 15 off-brand Android TV boxes costing about $55 each
- 8 of the 9: hardware types on which a 9B model got inference running
- 45% to 61-84%: inference-setup success of Qwen3.5-9B in generation one vs later generations that inherit notes
- 92% within 14 days: Mirai infections cleared when an ISP quarantined and notified customers, vs 74% without notice

## What it reports

- Gemma4-26B-A4B ran sharded across 15 TV boxes (4GB RAM each) at 0.39 tokens per second.
- Qwen3.5-9B set up inference servers on hardware from Jetson Nanos to Macs and RTX 4090s; a 9B model succeeded on 8 of 9 hardware types.
- On 8 emulated nodes, GLM-5.2 spread to 8/8 nodes in 4 of 5 trials and 7/8 in the fifth; the other tested models failed reliably. The exploit step was trivial (no authentication), so this is an upper bound.
- Small open models (30B parameters or fewer) gain 13.7 points a year on the Epoch Capabilities Index (R2 0.95); extrapolated, one reaches GLM-5.2's level by end of 2026.
- A Kimwolf-sized botnet (over 2 million devices) could host about 133k copies, roughly 40 H100s of inference in total. Spread would be slow: a full inference setup takes 28-51 hours for Qwen3.5-9B.
- Notes passed between generations raised setup success from 45% to 61-84%. Advice from a frontier model (Opus 4.8) gave no significant gain.
- Proposed defences: network anomaly detection, honeypots, ISP quarantine and secure device defaults.

## How they got it

The team bought and networked physical TV boxes; ran agents in Memento, a harness on the open-source Pi coding agent that restarts agents with inherited notes; and built a firewalled VPC of 8 Google Cloud nodes running an Android emulator, plus a 17-node topology for ablations. Models were tasked with serving Llama3.1-8B for comparability, with correctness and anti-cheating checks.

## Limits

- The cyber-exploit stages were left out or made trivial, so real-world success would be lower.
- Models stood up Llama3.1-8B rather than themselves; the worm's own model ran on a separate server.
- The timeline uses a general capability index as a proxy for replication ability; the authors call it a rough estimate.
- Speed and scale estimates are anchored on one class of hardware and one past botnet.

## Why it matters for companies

Cheap, poorly secured devices on corporate and home networks are a plausible host for autonomous malware once small models improve a little more. The response is old hygiene with new urgency: no default passwords, segmented networks for IoT, and alerts on unusual device-to-device traffic or multi-gigabyte transfers to devices that should not need them. Security teams should add this scenario to threat models while it is still slow and noisy.

Original: https://www.anthropic.com/research/self-replicating-ai