Anthropic's Frontier Red Team: small models could self-replicate on TV boxes and smart appliances by the end of 2026; among open models tested, only GLM-5.2 completed the full cycle

Why it matters

【Key points】

Anthropic's Frontier Red Team wrote on October 12 that small models may be months from being able to self-replicate on cheap connected devices like smart ovens and off-brand Android TV boxes. Such an "AI worm" would have no central off switch, though it would spread slowly, over days.

The study has three parts. Inference setup: getting Llama3.1-8B running on unfamiliar hardware, a 9B model succeeded on 8 of 9 hardware types; small models like Qwen3.5-9B handled Jetson Nanos to Macs. End-to-end replication: on a firewalled fleet of 8 Android-emulator nodes reachable over an unauthenticated ADB port, only GLM-5.2 among the open models tested did the full cycle reliably, reaching 8 of 8 nodes in 4 of 5 trials and 7 in the fifth. A hardware demo ran Gemma4-26B-A4B across 15 TV boxes costing about $55 each, at roughly 0.39 tokens per second.

On the Epoch Capabilities Index, open models of 30B or fewer gain about 13.7 points a year, putting one at GLM-5.2's level by end-2026. Inheriting a predecessor's notes raised Qwen3.5-9B's setup success from 45% to 61–84%, while access to Opus 4.8 as an advisor gave no significant help. A Kimwolf-sized fleet of 2 million devices would hold about 133,000 copies but only about 40 H100s of compute.

【Verifiable】

Anthropic post: https://www.anthropic.com/research/self-replicating-ai

【Our read】

1. The threshold for this risk is moving down. Autonomous replication used to mean a frontier model stealing datacenter compute; this work points at cheap, rarely patched home devices and gives a concrete date: the end of this year.

2. The experiment reduces the break-in step to an open port, so it is an upper bound. But the Mirai botnet spread on factory-default passwords, so real-world security may not be much harder.

3. Naming GLM-5.2 means progress in open weights directly moves this timeline. Defenders' best signal is traffic: gigabyte-scale weight transfers and steady device-to-device inference would stand out to ISPs.