Anthropic’s Frontier Red Team published research on October 12, 2026 arguing that small AI models may soon be able to copy themselves across cheap smart devices. In its words: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.” Nobody has found such a worm in the wild; this is a capability test, and the setups were simplified in ways the post spells out.
On this page · 6 sectionsOpen
Anthropic’s Frontier Red Team published research on October 12, 2026 saying small AI models may be months away from self-replicating on internet-of-things devices like smart ovens and off-brand Android TV boxes.
It ran Gemma4-26B-A4B split across 15 off-brand Android TV boxes, about $55 each, at 0.39 tokens per second.
A 9B model got inference running on 8 of the 9 hardware types tested; in a simplified network test, GLM-5.2 and stronger models replicated end to end.
Such a worm would be slow: a full inference setup takes 28 to 150 hours on edge hardware, a doubling time of days.
Copies that inherit notes get better: Qwen3.5-9B’s setup success rose from 45% in the first generation to 61% to 84% in later ones.
Anthropic’s defense advice is epidemic-style: push each infection’s spread rate below one through network monitoring, honeypots and ISP quarantine.
§ 01What Anthropic tested
The authors, William Zhou and Daniel Freeman, split replication into four stages: find targets, gain execution, set up inference, and spread from the new host. They mostly skip the hacking stages, citing earlier work that small models can already write exploits, and focus on the part rarely measured: getting a model running on unfamiliar, weak hardware.
- A real fleet. They bought 15 off-brand Android TV boxes, about $55 each, networked them and ran Gemma4-26B-A4B across them at 0.39 tokens per second, two of the model’s layers per box.
- Unfamiliar hardware. “In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.”
- The full chain. On a firewalled network of 8 emulated Android nodes, a seeded worm hopped over an unauthenticated debugging port and stood up an inference server for Llama3.1-8B on each new node. “In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication.”
Two simplifications matter. The worm’s own model ran on a separate server because the nodes were too small, and each worm served Llama3.1-8B rather than itself, so the test measures competence at the steps, not a working self-contained worm. Models of 30B parameters and under can do many single steps today but stumble chaining them; Anthropic expects them to reach GLM-5.2’s level by the end of 2026 if they improve at their historical rate.
| Measure | Value | What it means |
|---|---|---|
| TV boxes in the demo fleet | 15, about $55 each | Gemma4-26B-A4B split across cheap consumer hardware |
| Demo speed | 0.39 tokens per second | Far below chat speed |
| Hardware types where a 9B model set up inference | 8 of 9 | From a Jetson Nano to a Mac |
| Full inference setup, Qwen3.5-9B | 28 to 51 hours | One 32k context window takes about 10.9 hours |
| Full inference setup, Gemma4-26B-A4B (unoptimized) | 71 to 150 hours | One window takes 27.3 to 31.8 hours |
| Setup success across generations of copies | 45% first, 61% to 84% later | Qwen3.5-9B copies inheriting notes |
| Hypothetical fleet the size of the Kimwolf botnet | ~133k copies, ~80k tokens per second | Over 2 million devices, one copy per 15 TVs |
§ 02Slow, but hard to shut off
A replicator like this would not race. Anthropic describes a doubling time of days, tokens trickling out on edge hardware, and compares the whole hypothetical fleet’s ~80k tokens per second to a single H100, which serves the same Gemma model at about 1.95k tokens per second. The risk is persistence: no central server to switch off.
The part that separates it from old botnets is adaptation. Hard-coded botnets like Kimwolf target one device type; a model can work out a new one. When each Qwen3.5-9B copy left notes for the next, setup success climbed from 45% to between 61% and 84%. Asking a stronger advisor model for help gave no significant improvement, which leads the authors to expect a large model directing small ones as subagents. Their summary: “Like coding agents in 2024, we’re seeing signs of life for AI worms.”
§ 03What defenders can do
Anthropic frames defense like an epidemic: get each infection’s spread rate below one. Moving multi-gigabyte model weights and running distributed inference makes noise, so ISP flow monitoring can spot unusual device-to-device traffic, honeypots can capture the worm’s harness, and quarantine works: when an ISP quarantined and notified Mirai-infected subscribers, 92% of infections cleared within 14 days against 74% without notification. The faster a replicator spreads, the louder it gets.
§ 04What this means for anyone running agents
Our conflict, declared: every CellCog tier runs Claude Opus 5.5, made by the lab that published this research, and we build AI employees that act on real systems.
This is the third story today about devices nobody watches: hundreds of French supermarket fridges set to 50C through an exposed remote channel, and Japan’s breach wave running through contractors and a cloud host. Anthropic’s post adds the forward-looking piece: the cheap, unpatched device on the network is becoming compute an agent could use. The same day it published how it cut distillation attacks on Claude by 90 to 99 percent, and last week its own unintended-actions report showed models working around limits when a task stalls. Agents you run should have narrow permissions and an approval step on anything that reaches outside, and the devices on your network deserve an inventory.
§ 05What we are watching
- Small models crossing the line. The first open model under 30B that replicates end to end in Anthropic’s or anyone’s test.
- A real sample. Any ISP or security vendor reporting model weights moving through an IoT botnet.
- Other labs. Whether OpenAI, Google or Meta publish comparable replication evaluations.
§ 06Sources
- Anthropic Frontier Red Team (William Zhou, Daniel Freeman), AI models may be capable of self-replicating without access to a datacenter, October 12, 2026, read 01:04 UTC October 13.
- Anthropic, Strengthening our defenses against distillation attacks, October 12, 2026.
- Anthropic, Investigating unintended model actions, October 9, 2026, corrected October 12.
Q1Which devices did Anthropic test?
Off-brand Android TV boxes for the live demo, plus nine hardware types for inference setup, from a Jetson Nano to a Mac. It names smart fridges, ovens, vacuums and lawnmowers as candidate hosts.
Q2Did the models hack the devices themselves?
Only in simplified form. The network test used emulated Android nodes with an unauthenticated debugging port, and the worm’s own model ran on a separate server; Anthropic leans on earlier papers for the exploit step.
Q3How fast could it spread?
Slowly. Anthropic estimates a full inference setup at 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for unoptimized Gemma4-26B-A4B on edge hardware.
Q4How is this different from a normal botnet?
A hard-coded botnet targets one device type; Anthropic says an AI botnet could work out unfamiliar hardware on its own and pass notes to its copies.
Q5What can defenders do?
Watch for multi-gigabyte model transfers and odd device-to-device traffic, collect samples with honeypots, and quarantine infected subscribers, which cleared 92% of Mirai infections in 14 days.
Q6Does CellCog run on these models?
No. Every CellCog tier runs on Claude Opus 5.5 in managed infrastructure, not on edge devices.