What Anthropic Measured, And What It Did Not Show
Anthropic's Frontier Red Team published a paper on 12 October, written by William Zhou and Daniel Freeman, arguing that small AI models may be months away from copying themselves onto commercial internet-of-things devices such as smart ovens and off-brand Android TV boxes. The figures below are the paper's own.
| Test | Result |
|---|---|
| Hardware types where a 9B model set up inference | 8 of 9 |
| GLM-5.2 replicating across an 8-node test network | All 8 nodes in 4 of 5 trials, 7 of 8 in the other |
| Gemma4-26B-A4B spread across 15 TV boxes | 0.39 tokens per second |
| Time for Qwen3.5-9B to set up inference | 28 to 51 hours |
| Growth of small open models (30B or fewer) | About 13.7 index points per year |
| Mirai infections cleared within 14 days | 92% with quarantine and notice, 74% without notice |
Qwen3.5-9B set up its servers on hardware ranging from Jetson Nano boards to Macs and RTX 4090 graphics cards. The authors split replication into four stages: finding targets, gaining execution, setting up inference and continuing from the new host. They kept the first two trivial on purpose. The test network exposed an Android debugging port with no authentication, so Anthropic calls its result an upper bound on real-world success. The conclusion is modest: the paper says there is no full rogue replicator yet, only 'signs of life'.
Why Cheap Devices Are The Likely First Hosts
Home and small-business devices might be the first targets, the authors write, because they are connected to the internet and have historically had minimal security. Anthropic bought 15 off-brand Android TV boxes at about 55 US dollars each, networked them and ran the Gemma4-26B-A4B model across them at 0.39 tokens per second, each box holding a few of the model's layers.
Boxes in this class typically ship with 1 to 4 GB of memory. At 4 GB each and 4-bit compression, four or more boxes can serve a 9B model and ten or more a 26B one, which is why a swarm of weak devices can host something capable.
Scale is the next question. The Kimwolf botnet infected over 2 million devices, mostly off-brand Android TV boxes. If every group of 15 such devices ran one copy of the 26B model, Anthropic estimates about 133,000 copies and 80,000 tokens per second in total, roughly the inference of 40 Nvidia H100 accelerators. That is a small amount of compute, and a replicator would spread slowly, with a doubling time of days. The harm in this model comes from a footprint with no single off switch, since the compute itself is small. The estimate rests on one class of hardware and one past botnet, as the authors note.
The End-Of-2026 Date Comes From A Trend Line
Anthropic's end-of-2026 date comes from a straight-line fit to open-weight models of 30B parameters or fewer, whose score on the Epoch Capabilities Index rises about 13.7 points per year, with an R-squared of 0.95.
Of the open-weight models tested, only GLM-5.2 completed the whole chain, reaching all 8 nodes in 4 of 5 trials and 7 in the fifth. Using it as the skill floor and a 4 GB TV box as the size ceiling, the trend line has a small model reaching that floor around the end of this year. The authors call the index a proxy for replication skill and the date a rough estimate.
Two more results cut both ways. When each Qwen3.5-9B copy inherited notes from the one before, its success at setting up inference rose from 45 percent in the first generation to between 61 and 84 percent in later ones. Access to a stronger advisor model, Opus 4.8, gave no measurable gain.
Outside views are cautious. Al Jazeera, reporting the paper on 13 October, quotes Roman Yampolskiy of the University of Louisville saying an AI worm could reason about unfamiliar devices and keep spreading without a human operator, and that today it is not an existential threat. Anthropic did not answer Al Jazeera's questions, which were sent outside business hours.
Four Checks For Offices, Shops And Small Sites
Anthropic frames defence like an epidemic: push R0, the number of new devices each infected device goes on to infect, below 1 so the replicator dies out. For an owner, that means four checks.
First, list every device on your network that has a processor, including TV boxes, cameras, conferencing units and storage boxes, then close inbound management ports and replace default credentials. Mirai spread through default manufacturer passwords, and the test worm needed only an Android debugging port with no authentication. The UK regime for consumer connectable products, in force since 29 April 2024, bans universal default and easily guessable passwords, and Anthropic cites that kind of rule as a way to shrink the pool of targets.
Second, ask your internet provider or managed-network vendor whether it watches flow data. A replicator would leave multi-gigabyte model downloads and steady traffic between machines that do not normally talk, and the paper says provider-side monitoring could see both. Third, ask whether infected customers are quarantined and notified: in the Mirai clean-up, an ISP that did so cleared 92 percent of infections within 14 days, against 74 percent with no notification.
Fourth, ask device suppliers how they will meet the EU Cyber Resilience Act. The European Commission says its reporting duties for actively exploited vulnerabilities apply from 11 September 2026 and the main obligations from 11 December 2027, so a supplier with no answer is a supplier to replace at the next refresh.
Read next: 2014 Bugs Still Open Doors For A Chinese Contractor | Anthropic's Free OSS Scanner Sends Unreviewed Reports
