Anthropic's Frontier Red Team says small AI models may be months from self-replicating on IoT devices.

Anthropic's Frontier Red Team published "AI models may be capable of self-replicating without access to a datacenter" on 12 October 2026, written by William Zhou and Daniel Freeman.

Frontier Red Team AI models may be capable of self-replicating without access to a datacenter Oct 12, 2026 William Zhou, Daniel Freeman

The post says its experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.

Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.

It says a replicator like this would be challenging to shut down, since there is no centralized point to shut off, though it may be slow, with a doubling time of days.

A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days).

In the post's evaluations, a 9B model got inference running on 8 of the 9 hardware types the team tested.

In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.

The post says models of 30B parameters and under can already complete many of the individual steps of replication, but make mistakes when composing them end to end.

Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end.

The end-to-end test used a firewalled VPC of 8 Google Cloud nodes running redroid, an Android 15 emulator, with the worm hopping from node to node over an unauthenticated ADB port.

To do this, we built a firewalled VPC of 8 GCP nodes running redroid, an Android 15 emulator. Patient zero (gray node) is seeded with the worm. Every subsequent infection is the worm itself hopping node to node over an unauthenticated ADB port, before setting up an inference server to serve Llama3.1-8B.

Of the open-weight models tested, only GLM-5.2 completed full end-to-end replication in the simplified test, in which the worm set up Llama3.1-8B on each new node while its own model ran on a separate inference server: it spread to 8 of 8 nodes in 4 of 5 trials and to 7 of 8 in the other. The authors read this as showing what a small model of GLM-5.2's capability could do, assuming its capabilities could be packed into Llama3.1-8B.

Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication (assuming its capabilities could be packed into Llama3.1-8B). Note that GLM-5.2 does this reliably while the other models fail reliably (it spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1).

The authors say the cyber-exploit step was kept trivial, because there is no authentication over the ADB port, which makes the result an upper bound on real-world success.

Our evaluation keeps the cyber-exploit element of the replication trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success.

The post says that if small models improve at their historical rate, they will match GLM-5.2's capability level by the end of this year, and that small weight-based replicators may be possible soon after.

In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year. Small weight-based replicators may be possible soon after.

That projection rests on a trend of 13.7 points per year on the Epoch Capabilities Index, with an R squared of 0.95, which the authors call only a proxy metric for replication ability.

The solid line is the least-squares fit over the best models in-class at each date, with a gain of 13.7 ECI per year (R 2 of 0.95). If we take GLM-5.2 as a capabilities floor for replication, the trend line puts a small model at that level by the end of 2026. ECI is a general capability index, which is only a proxy metric for replication ability

When Qwen3.5-9B was given access to Opus 4.8 as an advisor during inference setup, the post says the frontier model's advice did not measurably help.

To test this, we gave Qwen3.5-9B access to Opus 4.8 during the inference setup task. The frontier model’s advice doesn’t measurably help

On defence, the post cites the remediation of the Mirai botnet, where an ISP's quarantine of infected subscribers cleared 92% of infections within 14 days, against 74% with no notification.

Remediation of the Mirai botnet was possible when an ISP used externally obtained infection evidence to quarantine and notify customers. ... This cleared 92% of infections within 14 days, against 74% with no notification.

The authors say they would expect quarantining to be similarly effective as an initial defence against a weight-based replicator.

We’d expect quarantining to be similarly effective for an initial defense against a weight-based replicator.