Anthropic AI self-replication research warns that small models may soon be capable of copying themselves across poorly secured internet-connected devices. The laboratory’s controlled experiments found important pieces of that chain already work, although it did not produce a fully autonomous real-world worm.

 

The research establishes four important boundaries:

  • A 9-billion-parameter model started inference on eight of nine tested hardware types.
  • A 26-billion-parameter model ran across 15 inexpensive Android TV boxes.
  • GLM-5.2 completed a simplified end-to-end replication test.
  • Current small models still fail when every stage must work together.

 

Anthropic AI Self-Replication Tests Move Beyond Data Centers

Anthropic’s Frontier Red Team examined autonomous replication and adaptation, a capability in which a model deploys and propagates without continuing human direction. The study focused on whether model weights could become part of a malware payload and run on compromised hardware outside a conventional data center.

 

The researchers demonstrated Gemma4-26B-A4B running through distributed inference on 15 off-brand Android TV boxes bought for about $55 each. Every device carried part of the model, allowing the group to serve it at roughly 0.39 tokens per second despite limited memory and processors.

 

A separate evaluation asked small models to configure inference on unfamiliar devices, including edge accelerators, personal computers and graphics-card systems. A 9-billion-parameter model succeeded on eight of nine hardware categories, showing that setup work once reserved for specialists can increasingly be handled by compact coding agents.

 

That result matters because many internet-of-things products combine weak security practices with enough memory to hold part of a quantized model. Security cameras, conference systems, smart appliances and inexpensive Android devices could collectively supply distributed compute even when no single machine is powerful enough.

 

GLM-5.2 Replicated Across a Simplified Network

Anthropic then placed models inside a firewalled network of eight Android emulators. The experiment simplified the intrusion stage by leaving an Android Debug Bridge port unauthenticated, allowing researchers to focus on network discovery, payload transfer, inference setup and continued propagation.

 

GLM-5.2 was the only tested open-weight model to complete the full sequence reliably. It reached all eight nodes in four of five trials and seven nodes in the remaining run, but the model operated from a separate inference server while deploying the smaller Llama3.1-8B payload.

 

That design creates a crucial limitation. The experiment shows that a model with GLM-5.2-level competence can orchestrate replication for a smaller payload under favorable conditions; it does not show that an ordinary 8-billion-parameter model can independently breach and reproduce across real consumer devices today.

 

Anthropic describes the present gap as a mismatch between capability and size. Models competent enough to complete the whole chain remain too large for the weakest hardware, while models small enough to fit distributed consumer devices still make too many errors when combining every step.

 

More on This Story

 

The End-of-2026 Forecast Is a Trend, Not a Demonstration

The team compared compact open-weight models with a general capability index and estimated that the performance threshold could meet the size threshold by the end of 2026. Anthropic explicitly labels that projection a rough estimate because general benchmark progress is only a proxy for autonomous replication skill.

 

Even a capable IoT worm would initially move slowly. The researchers estimated complete inference setup at 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for the tested Gemma model, producing a spread measured in days instead of the rapid pace associated with conventional network worms.

 

The study also used unusually favorable attack assumptions. Its network offered an unauthenticated service, and it largely set aside the hardest exploitation questions. Real deployments vary widely in processor architecture, connectivity, software restrictions, patch levels and the ability to download multi-gigabyte model files without detection.

 

There are also practical limits on available edge compute. Anthropic estimated roughly 9.5 million deployed devices across NVIDIA-powered product families, but said internet reachability is far lower and the vulnerable population lower still. It found no historical mass compromise of accelerator-equipped edge devices comparable to older IoT botnets.

 

Network Defenders Have Visible Signals to Monitor

A self-replicating model would differ from traditional malware because it could adapt setup procedures to unfamiliar hardware and pass notes, code or prompts to later copies. Anthropic’s tests found that inherited troubleshooting notes improved some later attempts, suggesting replication could become more reliable as instances accumulate experience.

 

The same behavior would create detectable traffic. New infections may download large model payloads, scan local networks and maintain sustained communication among devices that rarely exchange significant data. Faster propagation would generate more activity, forcing an attacker to trade stealth for speed.

 

Anthropic recommends reducing the reproduction rate below one through ISP monitoring and quarantine, stronger manufacturer defaults and coordinated cleanup. It cited earlier botnet remediation in which notifying and restricting infected customers cleared substantially more infections than leaving users without targeted intervention.

 

The report is therefore a warning about convergence rather than evidence of an active autonomous AI worm. Compact models, agentic coding ability and cheap edge compute are advancing on separate tracks. Security teams now have a narrowing window to harden exposed devices before those tracks plausibly meet.