AI models may be capable of self-replicating without access to a datacenter
A · Strong evidence Anthropic Frontier Red Team study with physical hardware rigs, a contained emulated network, repeated trials and stated caveats; strong evaluation evidence, though the timeline rests on one capability-index trend.
Summary based on the full text·Original: about 25 minutes to read
In short
William Zhou and Daniel Freeman of Anthropic's Frontier Red Team test whether small open-weight models can copy themselves onto cheap internet-connected devices and run there. They ran a 26B model across 15 TV boxes, had models set up inference on unfamiliar hardware, and released a worm into a firewalled fleet of emulated Android nodes. Only GLM-5.2 completed the full cycle reliably. On the trend in small-model capability, they estimate a model small enough for such devices could reach that level by end of 2026. They describe the threat as near-term, not current.
Key numbers
- 8/8 nodes in 4 out of 5 trialsGLM-5.2 end-to-end replication across an emulated Android fleet with an unauthenticated port
- 0.39 tokens per secondGemma4-26B-A4B speed sharded over 15 off-brand Android TV boxes costing about $55 each
- 8 of the 9hardware types on which a 9B model got inference running
- 45% to 61-84%inference-setup success of Qwen3.5-9B in generation one vs later generations that inherit notes
- 92% within 14 daysMirai infections cleared when an ISP quarantined and notified customers, vs 74% without notice
As reported by the source.
English·Web page·opens anthropic.com
What it reports
- Gemma4-26B-A4B ran sharded across 15 TV boxes (4GB RAM each) at 0.39 tokens per second.
- Qwen3.5-9B set up inference servers on hardware from Jetson Nanos to Macs and RTX 4090s; a 9B model succeeded on 8 of 9 hardware types.
- On 8 emulated nodes, GLM-5.2 spread to 8/8 nodes in 4 of 5 trials and 7/8 in the fifth; the other tested models failed reliably. The exploit step was trivial (no authentication), so this is an upper bound.
- Small open models (30B parameters or fewer) gain 13.7 points a year on the Epoch Capabilities Index (R2 0.95); extrapolated, one reaches GLM-5.2's level by end of 2026.
- A Kimwolf-sized botnet (over 2 million devices) could host about 133k copies, roughly 40 H100s of inference in total. Spread would be slow: a full inference setup takes 28-51 hours for Qwen3.5-9B.
- Notes passed between generations raised setup success from 45% to 61-84%. Advice from a frontier model (Opus 4.8) gave no significant gain.
- Proposed defences: network anomaly detection, honeypots, ISP quarantine and secure device defaults.
How they got it
The team bought and networked physical TV boxes; ran agents in Memento, a harness on the open-source Pi coding agent that restarts agents with inherited notes; and built a firewalled VPC of 8 Google Cloud nodes running an Android emulator, plus a 17-node topology for ablations. Models were tasked with serving Llama3.1-8B for comparability, with correctness and anti-cheating checks.
Limits
- The cyber-exploit stages were left out or made trivial, so real-world success would be lower.
- Models stood up Llama3.1-8B rather than themselves; the worm's own model ran on a separate server.
- The timeline uses a general capability index as a proxy for replication ability; the authors call it a rough estimate.
- Speed and scale estimates are anchored on one class of hardware and one past botnet.
Why it matters for companies
Cheap, poorly secured devices on corporate and home networks are a plausible host for autonomous malware once small models improve a little more. The response is old hygiene with new urgency: no default passwords, segmented networks for IoT, and alerts on unusual device-to-device traffic or multi-gigabyte transfers to devices that should not need them. Security teams should add this scenario to threat models while it is still slow and noisy.
Summary based on the full text. Read the original for the full argument and data.Read the original on anthropic.com