Anthropic: AI self-replication is months away

Anthropic's Frontier Red Team bought fifteen off-brand Android TV boxes at about $55 each, networked them together, and ran a 26-billion-parameter open-weight model across the cluster. It worked, at 0.39 tokens per second. Slow, but working.

The report, published October 12 by researchers William Zhou and Daniel Freeman, is the most concrete thing written this year about AI self-replication. The headline: small models may be months away from copying themselves across commercial IoT devices, like smart ovens and off-brand Android TV boxes, with no data center involved. Such a replicator would be hard to stop, because there is no central switch to flip.

The experiments are worth taking seriously precisely because the team tested the hard part. Getting inference running on unfamiliar, weak hardware is the bottleneck for a self-spreading model. Here the results are striking. Qwen3.5-9B set up inference on eight of the nine hardware types thrown at it, and its success rate climbed from 45 percent to between 61 and 84 percent as the agent inherited notes across generations. It figured out the hardware. The Gemma4-26B-A4B cluster, with each box holding a slice of the model's layers via pipeline parallelism, demonstrates that a capable model does not need a data center at all.

But the full chain is a different story, and the report is honest about it. Of the open-weight models tested, only GLM-5.2 completed end-to-end replication, reaching all eight contained nodes in four of five trials. Models under 30 billion parameters could complete the individual steps but, as Reuters summarized, struggled to complete the entire sequence from start to finish. And the methodology carries hedges the headlines mostly skipped. The cyber evaluation keeps the exploit step "trivial," think unauthenticated ADB ports. The Edge Compute Index the team uses is, in their own words, only a proxy metric for replication ability. The small models' spear-phishing capability rated "very poor to poor." The team calls its own result an upper bound on real-world success.

Then there is the projection. If small models keep improving at their historical rate, the authors write, they will match GLM-5.2's replication capability by the end of 2026, with small weight-based replicators possible soon after. That is a trend extrapolation, not a demonstrated capability in a 9-billion-parameter model today. The distinction matters because the economics are modest: at Kimwolf-botnet scale, two million infected devices mostly off-brand Android TVs, the authors estimate the pool could host about 133,000 concurrent copies of the 26B model, roughly 40 H100-equivalents of compute. Enough for self-perpetuation. Not enough for anything useful. A replication cycle takes 28 to 150 hours per node. These would be slow worms.

Not everyone is impressed. One named researcher quoted in coverage called the framing fear-mongering driven marketing, and a contrarian tier-one take notes the obvious: the tests used purpose-built insecure nodes, only one of many models succeeded, and basic hygiene closes the demonstrated gap. That is a fair objection and also the point. The report's threat model assumes the Mirai template: poorly secured devices, default credentials, open ports. That template is not hypothetical. It infected millions of real devices.

So what should a security team actually do? The report's own recommendation is unglamorous: strengthen systems to make it harder for AI agents to spread. Close the unauthenticated ADB ports. Segment the IoT fleet from anything that matters. Treat any sub-30B open-weight model as capable of attempting replication, because the individual steps are falling into place even if the full chain is not. And read the year-end date as a planning input, not a prophecy. Anthropic's researchers close with a line worth quoting: "We expect a future awash with agents running on all types of hardware, including some that aren't under human control." The TV boxes were $55 each. The future they describe is cheap.

What remains unknown: whether the improvement-rate extrapolation holds, whether anyone demonstrates the full chain without the trivialized exploit step, and which of the three replication architectures the report sketches (weight-based, orchestrator, API-relay) turns out to be the practical one. The report is early evidence from a red team, in its own words, with its own caveats. Treat it that way.

Related: rogue agents are already a production problem, and the first wave of agentic attacks showed how fast agent tooling gets weaponized. This report is the next step in that sequence.