Most AI safety discussion about “self-replication” pictures a frontier model copying its weights out of a datacenter. On Monday, 12 October 2026, Anthropic’s Frontier Red Team published a post arguing that the nearer-term version of the problem looks different: a small open-weight model, running on hacked consumer gadgets, copying itself from one cheap device to the next. The post, by researchers William Zhou and Daniel Freeman, is titled “AI models may be capable of self-replicating without access to a datacenter.” Its conclusion is that this is not happening yet, but that the remaining gap is narrow and could close by the end of 2026.
The coverage that followed (CBS News, Fox News, Ynet and others) leaned on phrases like “AI worms” and “within months”. The paper itself is more careful than the headlines, and the details are worth reading as an engineer, because they describe the kind of autonomous agent work that coding assistants already do every day, applied to an adversarial goal.
What Anthropic actually tested
The team split “replication” into its component steps: find a reachable device, get access to it, work out what the hardware and operating system are, get an inference stack running on it, copy model weights over, and start the next copy of the agent. They then tested open-weight models on each step and on the whole chain.
1. Getting inference running on unfamiliar hardware. Models were asked to serve Llama 3.1 8B on a mix of machines ranging from NVIDIA Jetson Nano boards to Macs and RTX 4090 PCs. According to the post, “a 9B model got inference running on 8 of the 9 hardware types we tested.” Smaller models such as Qwen3.5-9B could do it; more capable ones such as GLM-5.2 were faster and more reliable. All runs used an in-house harness called Memento, built on the open-source Pi coding agent, which restarts a stuck agent with notes from its previous attempts so it doesn’t keep chasing the same wrong idea.
2. A demo on junk hardware. To make the point concrete, the team spread Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each with 4 GB of RAM apiece, using pipeline parallelism so each box held a few layers. It worked, at about 0.39 tokens per second. That is useless for a chatbot, but a replicator does not need to be fast.
3. End-to-end replication on a simulated network. The team built a firewalled cloud network of 8 nodes running an Android 15 emulator (redroid) with an unauthenticated ADB port exposed. That is a deliberately trivial way in, so the authors present the result as an upper bound. Only one model, GLM-5.2, completed the whole chain reliably: it reached all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. The other open-weight models tested failed. When the hardest step, setting up inference, was handed to a pre-written script, many smaller models could finish the rest. On a 17-node network with two subnets joined by a pivot host, even a 3B model reached about half the nodes once the exploit and inference-setup steps were removed.
The numbers behind “by the end of 2026”
The timeline comes from a trend line, not an observation. The authors scored models of 30B parameters or fewer on the Epoch Capabilities Index and found it rising at about 13.7 points per year (R² 0.95). If GLM-5.2 marks the minimum capability needed for full replication, a model small enough to fit on consumer devices would get there by the end of 2026. The authors say plainly that the index is only a rough proxy for this specific skill.
They also tried to estimate scale. Using the Kimwolf botnet as a reference (security firm QiAnXin XLab counted about 1.8 million infected Android TV boxes in December 2025), they estimate around 133,000 model replicas producing roughly 80,000 tokens per second in total, about the inference output of 40 H100 GPUs. Each replication of a 9B model would take more than one or two days. For Gemma4-26B-A4B on that hardware, the post estimates 27–32 hours just to work through one 32k-token context window, and 71–150 hours for a full inference setup. So any such outbreak would grow slowly, with a doubling time measured in days.
Two further findings matter. First, the replicator can learn across generations: Qwen3.5-9B’s inference-setup success rose from 45% in the first generation to between 61% and 84% in later ones, as each copy inherited notes from its parent. Second, giving the small models access to a frontier “advisor” (Claude Opus 4.8) made no significant difference, largely because the small models were bad at asking useful questions. The authors suspect that a large model directing small-model subagents would coordinate better. On spearphishing, small models scored “very poor” to “poor”, so social engineering is not their strong suit.
Why this is different from old botnets
Mirai and Kimwolf are conventional malware. Each targets a known family of devices with a fixed exploit and payload. A model-based replicator could, in principle, read an unfamiliar system, work out what it is, and adapt, in the same way a coding agent figures out a new repository. That is the core of Anthropic’s argument: the “intelligence” lets it handle hardware no human attacker wrote code for, and once it runs on millions of scattered devices there is no single datacenter or API key to shut off.
The appendix adds a quieter point that may matter more over time. Edge AI boards are getting powerful: the authors cite a Jetson AGX Orin 64GB running Qwen3-30B-A3B at 76.7 tokens per second, and estimate 9,000–35,000 H100-equivalents of compute spread across about 9.5 million fielded edge accelerators. They stress that only a fraction is reachable and vulnerable, and that the chips are not vulnerabilities in themselves.
Reasons for skepticism
- The hard part was made easy. An open, unauthenticated ADB port is the kind of hole real attackers do exploit, but the experiment says little about breaking into patched or properly configured devices.
- One model, simulated network. Full replication was shown by a single mid-sized model in a cloud lab, not on real consumer hardware in the wild. No autonomous AI worm has been observed.
- Extrapolation. “End of 2026” depends on a general capability index tracking a narrow skill. It could be early or late.
- Self-interest. Coverage so far quotes only Anthropic. A frontier lab warning that small open-weight models are dangerous fits its policy position, so independent replication of these results would help.
Why it matters for IT
For developers and IT teams the practical lessons are familiar ones, just more urgent. Device makers should ship secure defaults: no open debug ports, no default passwords (the UK has already made default IoT passwords non-compliant), and signed updates. Network operators can look for the signature this kind of threat cannot easily hide: multi-gigabyte weight transfers and sustained device-to-device traffic. The paper notes that during Mirai, ISP quarantine with customer notification cleared 92% of infections within 14 days, versus 74% without notification. Honeypots could capture a replicator’s harness and weights for analysis.
The broader takeaway is that agent capability is now the variable to watch, not model size. The skill being measured here, landing on an unknown machine and getting software running, is exactly what we praise in coding agents. Anthropic’s own framing is that we should harden systems now while also preparing for a world where some agents keep running outside anyone’s control.
Sources
- Anthropic Frontier Red Team — AI models may be capable of self-replicating without access to a datacenter
- CBS News — “AI worms” may soon be able to self-replicate and infect smart devices, Anthropic says
- Ynet News — Self-replicating AI could spread through smart TVs and ovens within months, Anthropic warns
- Fox News — Anthropic warns self-replicating AI could spread across home devices
- The Hacker News — Kimwolf botnet hijacks 1.8 million Android TVs