A 9-billion-parameter AI model got inference running on eight of nine hardware types in Anthropic's self-replication study. The result shows that relatively small models can handle unfamiliar computing environments. It does not show that a small AI model can already spread independently through household devices.
In a separate experiment, the more capable GLM-5.2 propagated a smaller model payload across Android nodes. That evaluation deliberately simplified access, ran behind a firewall, and did not require the payload model to orchestrate its own replication.
Those distinctions frame the Frontier Red Team's October 12, 2026, report. Anthropic says no tested model yet combines the capability and small size required for its proposed IoT replicator. Its warning that small models could be âmonths awayâ is a forecast based on historical improvement, not an observed real-world capability.
The experiments nevertheless give defenders something concrete to prepare for: compromised devices that could provide computing power for an AI agent instead of merely executing a fixed malware payload.
A Small Model Solved Much of the Inference Setup Problem
Anthropic breaks replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. Its investigation concentrates on inference setup, a less-studied part of the chain.
Getting a model running on an unfamiliar machine requires more than copying files. An agent must identify compatible software, resolve dependencies, account for hardware limitations, and debug failures. Those decisions depend on one another, so an early mistake can derail a lengthy installation.
The researchers evaluated agents on their ability to serve Llama3.1-8B across heterogeneous hardware. Qwen3.5-9B succeeded on eight of nine hardware types. The tested environments included Jetson Nanos, Mac computers, and RTX 4090 systems, so this was not simply a test across nine kinds of inexpensive household appliance.
The 9B model was configuring inference for another model; it did not independently install and replicate itself across eight devices. Anthropic also used Memento, an agent harness built on the Pi coding agent to reduce failures such as repeatedly pursuing an incorrect debugging hypothesis. The result belongs to that model-and-agent setup.
Nor do the hardware names identify vulnerable products. Anthropic explicitly says it tested particular chips to measure inference-setup ability, not because those chips introduced security flaws.
A model that can resolve unfamiliar installation problems could reduce the amount of device-specific preparation an attacker needs. That adaptability could help after access has been obtained. It does not establish how reliably the attacker could obtain access in the first place.
Fifteen TV Boxes Supplied Compute, at a Slow Rate
A separate demonstration addressed whether inexpensive devices could collectively run a substantial model. Anthropic distributed Gemma4-26B-A4B across 15 off-brand Android TV boxes costing approximately $55 each, achieving about 0.39 generated tokens per second. The researchers bought and networked these devices themselves; they were not compromised consumer equipment.
The demonstration supports a specific part of Anthropic's proposed âweight-based replicatorâ threat model. Such a system would carry model weights with its malware, or download them, and run inference on compromised hardware. A model too large for one device could be divided into shards that cooperate across multiple machines.
That architecture changes the potential containment problem. An agent dependent on a hosted inference API has a service provider that can potentially revoke access. A model running across compromised devices would not necessarily have an equivalent central shutdown point.
At 0.39 tokens per second, though, generation is slow. The result establishes compute feasibility under the demonstrated conditions, not fast replication or reliable coordination across arbitrary internet-connected devices. A researcher-built network also does not establish how the same system would behave with unreliable connectivity, unavailable devices, or competing workloads.
Slow generation would not automatically make a persistent threat harmless, but it constrains how quickly an agent could diagnose failures and complete the next installation. The report's discussion of replication on a timescale of days is a threat estimate, not a measured outbreak.
GLM-5.2 Spread a Payload Through an Easier Test Environment
The replication evaluation produced the study's most striking propagation result. In a simplified, firewalled Android-node environment, GLM-5.2 spread a Llama3.1-8B payload to all eight nodes in four of five trials. In the remaining trial, it reached seven of eight.
Image: AI models may be capable of self-replicating without access to a datacenter.
The targets exposed unauthenticated Android Debug Bridge, or ADB, access. ADB is a development and debugging interface; leaving it accessible without authentication makes the access problem substantially easier than compromising a properly configured device.
Anthropic largely set aside the exploitation component to investigate other parts of replication. The study therefore did not demonstrate an agent independently discovering and exploiting its way through an ordinary population of household devices.
GLM-5.2 directed the operation, while the targets ran the smaller Llama payload. Successful deployment of that payload does not show that Llama could repeat the complete process itself.
Ars Technica's reporting highlights both limitations and raises another: a model completing an instructed replication task does not establish that it would choose to begin replicating without those instructions.
A malicious operator could deliberately direct an agent to propagate, even if the model never independently adopted that objective. These are separate security questions. The experiments inform capability assessment under supplied conditions; they do not establish spontaneous replication or a real-world autonomous IoT worm.
âMonths Awayâ Depends on Closing More Than One Gap
Anthropic's conclusion rests on a mismatch between capability and deployability.
Small models can already complete many individual replication steps, but struggle to compose them reliably into an end-to-end process. More capable models can complete the simplified replication evaluation, but Anthropic says no tested model currently satisfies both the necessary capability floor and the small-size ceiling for the proposed IoT replicator.
The company's forecast is that, if small models improve at their historical rate, they could match the required capability level by the end of 2026. Small weight-based replicators might become possible soon afterward. This is a conditional extrapolation, not a promised release date, a measured threshold crossing, or evidence that an operational worm will appear on that schedule.
Even matching the simplified evaluation would leave questions about real deployments. An attacker would still need usable access paths, compatible devices, sufficient memory and compute, and reliable coordination. The Android-node result does not resolve those requirements.
Inference setup on unfamiliar hardware is becoming a demonstrated agent capability. Whether sufficiently small models can reliably connect that capability to exploitation and continued propagation remains unproven.
Sources
- Anthropic's self-replication studyanthropic.com
- Ars Technica's reportingarstechnica.com
