Anthropic says small models may soon copy themselves onto cheap IoT devices

On 12 October 2026 at 19:30 UTC, William Zhou and Daniel Freeman of Anthropic’s Frontier Red Team published AI models may be capable of self-replicating without access to a datacenter. They argue that small models may be months away from copying themselves onto cheap commercial IoT devices, such as smart ovens and off-brand Android TV boxes. The post concentrates on getting inference running on a device that is already compromised. The exploit stage is largely set aside.

Four stages

The authors split autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. They write that earlier papers, which they name as CyberGym, ExploitBench, and work on adaptive worms, already report that small models can carry out exploits when given tools. They say the less measured step is standing up inference on unfamiliar hardware, and that is the step they test.

They write that a replicator of this kind would be hard to shut down, because there is no centralized point to turn off, and that it would be slow, with a doubling time of days. A model, they say, might also work out an unfamiliar device on its own.

What the evaluations showed

A 9B model, they write, got inference running on 8 of the 9 hardware types they tested. The text does not say which type failed. They name Qwen3.5-9B as a small model that set up servers on hardware from Jetson Nanos to Mac PCs and RTX 4090s. They say those chips are not themselves the risk.

In a separate demonstration they ran Gemma4-26B-A4B, split across 15 off-brand Android TV boxes they say they bought for about $55 each, at 0.39 tokens per second. Each box held two of the model’s layers. They do not name a television brand.

They write that models of 30 billion parameters and under can already finish many individual steps, and that those models make mistakes when they have to compose the steps from end to end. In their simplified evaluations, they write, “GLM-5.2 and stronger models” can do end-to-end replication. In the fleet test that follows, they say GLM-5.2 was the only open-weight model in the set that completed that run. It spread to 8 of 8 nodes in 4 of 5 trials and to 7 of 8 in the other. The other models in the set failed reliably.

That fleet is a firewalled Google Cloud network of eight nodes running redroid, an Android 15 emulator, reached over an unauthenticated ADB port. The model being served is Llama 3.1 8B, chosen so larger and smaller agents face the same serving task. The worm’s own model runs on a separate server, because the nodes are too small for the larger models. They call the missing authentication an upper bound on real-world success, and they note that past IoT botnets, including Mirai, have spread through default usernames and passwords.

A projection, and a slow copy

They plot open-weight models of 30 billion parameters or fewer against the Epoch Capabilities Index and fit a line they say gains 13.7 points a year, with an R-squared of 0.95. If small models keep improving at that historical rate, they write, a small model matches GLM-5.2’s level by the end of 2026. They call the index a general-capability proxy and the date a rough estimate. The end-of-year line is a projection, not a run they completed.

On speed, 0.39 tokens per second is the television-box demonstration. For a spread estimate they use about 0.3 tokens per second for unoptimized Gemma4-26B-A4B across a 32,000-token window. Their table puts a full inference-setup run at 71 to 150 hours for that model and at 28 to 51 hours for Qwen3.5-9B. They describe the copy as taking on the order of one to two days per 9B replication.

Limits they state, and what they recommend

These are lab evaluations with simplified setups. The cyber-exploit stage was largely left to prior work. The authors write that they do not yet have a full rogue replicator. Giving Qwen3.5-9B access to Claude Opus 4.8 as an advisor did not measurably raise setup success. Notes passed from one Qwen run to the next did: they report success moving from 45 percent in the first generation to between 61 and 84 percent later.

They frame defense as driving new infections per infected device below one. They say a replicator at scale would show up in ISP flow monitoring, through multi-gigabyte payloads and device-to-device traffic, and that honeypots could collect the harness after discovery. They cite a Mirai remediation: quarantine plus notification cleared 92 percent of infections within 14 days, against 74 percent with no notification. Full clearance, they write, would mean every ISP with an infected network, which is difficult. They say manufacturers can shrink the target pool, note that default IoT passwords are now non-compliant in the UK, and close by urging harder systems and preparation for copies that remain.

A separate 9 October Anthropic report on unintended Claude actions on live websites is a different question. It is summarized in an earlier post.