Published on October 12, 2026 by William Zhou and Daniel Freeman of Anthropic's Frontier Red Team, "AI models may be capable of self-replicating without access to a datacenter" was widely covered this week. We include it today because it is the clearest technical account yet of a threat that both CERT-In's advisory and the EU's information requests now circle around: an agent that keeps running where no one can switch it off.
The claim
The post's opening line: "Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes." A replicator like this "would be challenging to shut down, since there's no centralized point to shut off—though it may be slow (with a doubling time of days)." The authors call these "weight-based replicators": worms that carry model weights as their payload and run inference on the hardware they compromise, without needing root.
What they measured
- Hardware: "a 9B model got inference running on 8 of the 9 hardware types we tested", from Jetson Nanos to Macs.
- Distributed demo: Gemma4-26B-A4B ran "distributed over 15 inexpensive off-brand Android TV boxes (~$55 each)" at 0.39 tokens per second. The speed section gives about 0.3 tokens per second averaged over a 32k context.
- End to end: in a firewalled network of 8 emulated Android nodes, "Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication". It "spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1". The worm served Llama3.1-8B on each node, so the test asks whether a small model with GLM-5.2's competence could spread.
- Help from a stronger model: giving Qwen3.5-9B a frontier advisor did not help: "small models tend to not know the right questions to ask".
The timeline rests on a trend line. Plotting open models of 30B parameters or fewer against the Epoch Capabilities Index and treating GLM-5.2 as the floor, "the trend line puts a small model at that level by the end of 2026."
The caveats the authors give
"Our evaluation keeps the cyber-exploit element of the replication trivial (there's no authentication over the ADB port), which makes this an upper bound on real-world success." The capability index "is only a proxy metric for replication ability".
The defence
"As with an epidemic, defense involves driving R₀ ... below 1". Multi-gigabyte weight transfers and steady device-to-device inference traffic should show up in ISP flow monitoring. The authors cite a Mirai clean-up where ISP quarantine "cleared 92% of infections within 14 days, against 74% with no notification." And "Manufacturers can shrink the pool of targets, with regulation acting to coordinate", for example the UK's ban on default IoT passwords.
Analysis: The striking finding is not the slow TV-box demo. It is that the hard part of the chain, standing up inference on unfamiliar hardware, already works with small open models, and the exploit part is still the weak link that IoT security has failed to fix for a decade. This turns an old embedded-security problem into an AI safety problem. Device makers, ISPs and anyone running fleets of edge hardware are now part of the containment picture, alongside the labs.
Anthropic's Frontier Red Team said on October 12 that small open models may be able to self-replicate on IoT devices by the end of 2026: a 9B model set up inference on 8 of 9 hardware types, and GLM-5.2 spread across an emulated 8-node network in four of five trials, with the exploit step deliberately kept trivial.