A 9-billion-parameter AI model got inference running on eight of nine hardware types in Anthropic's self-replication study. The result shows that relatively small models can handle unfamiliar computing environments. It does not show that a small AI model can already spread independently through household devices.
In a separate experiment, the more capable GLM-5.2 propagated a smaller model payload across Android nodes. That evaluation deliberately simplified access, ran behind a firewall, and did not require the payload model to orchestrate its own replication.
Those distinctions frame the Frontier Red Team's October 12, 2026, report. Anthropic says no tested model yet combines the capability and small size required for its proposed IoT replicator. Its warning that small models could be “months away” is a forecast based on historical improvement, not an observed real-world capability.
The experiments nevertheless give defenders something concrete to prepare for: compromised devices that could provide computing power for an AI agent instead of merely executing a fixed malware payload.
A Small Model Solved Much of the Inference Setup Problem
Anthropic breaks replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Its investigation concentrates on inference setup, a less-studied part of the chain.
Getting a model running on an unfamiliar machine requires more than copying files. An agent must identify compatible software, resolve dependencies, account for hardware limitations, and debug failures. Those decisions depend on one another, so an early mistake can derail a lengthy installation.
The researchers evaluated agents on their ability to serve Llama3.1-8B across heterogeneous hardware. Qwen3.5-9B succeeded on eight of nine hardware types. The tested environments included Jetson Nanos, Mac computers, and RTX 4090 systems, so this was not simply a test across nine kinds of inexpensive household appliance.
The 9B model was configuring inference for another model; it did not independently install and replicate itself across eight devices. Anthropic also used Memento, an agent harness built on the Pi coding agent to reduce failures such as repeatedly pursuing an incorrect debugging hypothesis. The result belongs to that model-and-agent setup.
Nor do the hardware names identify vulnerable products. Anthropic explicitly says it tested particular chips to measure inference-setup ability, not because those chips introduced security flaws.
A model that can resolve unfamiliar installation problems could reduce the amount of device-specific preparation an attacker needs. That adaptability could help after access has been obtained. It does not establish how reliably the attacker could obtain access in the first place.
