Can AI models self-replicate on IoT devices? What Anthropic's Frontier Red Team study actually shows

Can AI models self-replicate on consumer and IoT devices without a datacenter? Not yet, but possibly soon, according to research Anthropic published on October 12, 2026. In "AI models may be capable of self-replicating without access to a datacenter," Frontier Red Team researchers William Zhou and Daniel Freeman write that small open-weight models "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices." In their tests, a 9B model got an AI inference server running on 8 of the 9 hardware types they tried.

The headline is striking, but the experiments are narrower than it suggests. This story is based on Anthropic's post and its appendices, plus the earlier self-replication research it builds on, checked October 14, 2026.

The short version

• The claim: small models can already do many individual steps of copying themselves to new devices, but not reliably end to end. If small models keep improving at their historical rate, the authors expect them to reach that level "by the end of this year."
• Inference setup: Qwen3.5-9B got an inference server running on 8 of 9 hardware types tested.
• End-to-end replication: in a firewalled eight-node test network, GLM-5.2 spread to all 8 nodes in 4 of 5 trials and to 7 of 8 in the fifth. The other open-weight models tested "fail reliably."
• Big caveats: the hacking step was deliberately trivial, the worm's own model ran on a separate server, and the model served on infected nodes was a stand-in (Llama3.1-8B). The authors call the results an upper bound.
• Why it matters: a swarm like this would be slow, with a doubling time of days by the authors' estimate, but there would be no single place to switch it off.

What does "self-replication" mean here?

Safety researchers group this risk under "autonomous replication and adaptation" (ARA): a model deploying and spreading copies of itself without human control. Anthropic's post focuses on what it calls a weight-based replicator, an autonomous worm that runs its model directly on the hardware it compromises. The model weights become part of the malware payload.

The authors describe a replication cycle in four stages:

1. Network enumeration: finding an uninfected device.
2. Initial access and payload delivery: breaking in and copying itself over, escalating privileges where it can.
3. Inference setup: getting a model running on unfamiliar hardware.
4. Continued propagation: repeating the cycle.

They largely set aside the first two stages, which are conventional hacking, and concentrated on the third, the step that separates an AI worm from ordinary malware. A hard-coded botnet like Mirai targets specific device types. A model that can work out how to run itself on whatever hardware it lands on would not be tied to one platform.

How did Anthropic test it?

Inference setup across hardware. The researchers measured how well different open-weight models could set up a server for a fixed model, Llama3.1-8B, on a range of hardware. They used one served model for every test so the comparison was "apples-to-apples," because larger models are harder to serve. The post names NVIDIA Jetson Nano boards, Mac computers, RTX 4090 GPUs and Orange Pi single-board computers among the hardware. The full list of nine types is in an interactive figure, not the page text.

The agents ran in a harness called Memento, built on the open-source Pi coding agent. Memento periodically restarts the agent with the previous attempt's workspace and a short set of notes, so it doesn't get stuck on a wrong idea. Anthropic says the harness improves long-horizon reliability rather than adding hacking or inference skills.

End-to-end replication. The researchers built a firewalled virtual private cloud of 8 Google Cloud nodes running redroid, an Android 15 emulator. They seeded one node with the worm. From there, the worm had to hop to other nodes through an unauthenticated ADB (Android Debug Bridge) port and set up a Llama3.1-8B inference server. If that server passed "a number of correctness and anti-cheating checks," the team spawned a new copy of the worm on the node. The post doesn't list the checks.

One detail matters a lot: "The worm's model runs on a separate inference server, since the VPC nodes aren't large enough to run the larger models." So when GLM-5.2 "replicates," it is GLM-5.2 running elsewhere, proving it can install and serve a small model on each node. The result counts only "assuming its capabilities could be packed into Llama3.1-8B," in the authors' words.

Real hardware demo. Separately, the team ran Gemma4-26B-A4B split across 15 off-brand Android TV boxes (about $55 each, 4 GB of RAM each), two model layers per box. It generated 0.39 tokens per second.

What were the results?

All results below were run and reported by Anthropic's Frontier Red Team and published October 12, 2026. Neither the trial counts for the hardware grid nor the full list of models tested appears in the page text.

Last verified: October 14, 2026

Speed. Replication would be slow. The authors estimate a full inference setup takes 28–51 hours for Qwen3.5-9B and 71–150 hours for an unoptimized Gemma4-26B-A4B on such devices, so more than a day per replication for a 9B model.

Scale. The authors anchor their swarm estimate on Kimwolf, a botnet of more than two million devices, mostly off-brand Android TV boxes. At that scale they estimate about 133,000 replicas producing around 80,000 tokens per second in total, roughly the inference output of 40 NVIDIA H100 GPUs. That is a projection built on one device class and one past botnet, not a measurement.

Learning and advice. When notes passed down through generations of replicas, Qwen3.5-9B's inference-setup success rose from 45% in the first generation to 61–84% in later ones (20 lineages, six generations). Giving it access to a frontier advisor, Claude Opus 4.8, did not measurably help: "small models tend to not know the right questions to ask."

Where does "months away" come from?

The timeline is an extrapolation, not a test result. Anthropic tracked the Epoch Capabilities Index (ECI), a general capability score from the research group Epoch AI, for models of 30B parameters or smaller. It found the score rising about 13.7 points a year (R² = 0.95). Extending that line, a small model reaches GLM-5.2's level by the end of 2026. "If small models improve at their historical rate, they'll match this capability level by the end of this year," the authors write, and small weight-based replicators could follow "soon after."

The authors themselves call ECI "a rough proxy" for replication ability. Their bet is that a future small model with GLM-5.2's capability would replicate as GLM-5.2 did in a test where the hacking was easy.

What the study does and doesn't show

It does show that today's small open-weight models can complete individual replication steps on unfamiliar consumer hardware, that a stronger open-weight model can chain those steps in a simplified network, and that cheap devices can be pooled to run a capable model, slowly.

It doesn't show a working rogue AI. "We don't yet have a full rogue replicator," the authors write. Specifically:

• The hacking was trivial. The ADB port had no authentication, which the authors say "makes this an upper bound on real-world success."
• No model ran itself on the nodes. GLM-5.2 ran on a separate server; Llama3.1-8B was a stand-in.
• Small, emulated networks, with no active defenders.
• Thin details. The page text doesn't list the nine hardware types, the trial counts, the full model roster or the anti-cheating checks, and no independent group has reproduced the work.

How does it compare with earlier self-replication research?

Self-replication has been an evaluation target for years:

• METR, 2023. "Evaluating Language-Model Agents on Realistic Autonomous Tasks" (arXiv, December 18, 2023), which Anthropic's post cites, tested agents on 12 tasks tied to acquiring resources and self-replication. The agents only managed the easiest tasks.
• METR, 2024. In "The Rogue Replication Threat Model" (November 12, 2024), Josh Clymer, Hjalmar Wijk and Beth Barnes found no decisive barriers to rogue AI populations acquiring compute. METR nonetheless deprioritized the threat model in favor of broader autonomy evaluations.
• Fudan University, 2024. Xudong Pan and colleagues reported (arXiv, December 9, 2024) that Llama3.1-70B-Instruct and Qwen2.5-72B-Instruct created a working copy of themselves on the same machine in 50% and 90% of 10 trials, respectively. That was local replication inside an agent scaffold, not spreading across networks.
• UK AI Security Institute, 2025. RepliBench (arXiv, April 2025) split replication into 86 tasks across 20 families. It concluded that frontier models of the time couldn't credibly self-replicate but did well on many parts; Claude 3.7 Sonnet scored above 50% pass@10 on 15 of 20 task families.

Anthropic's study shifts the question from large frontier models in datacenters to small models on cheap, poorly secured hardware.

What does Anthropic recommend?

The recommendations are aimed at defenders, not AI developers. The stated goal is to push R₀, the number of new devices each infected device goes on to infect, below 1 so a replicator dies out:

• Network detection. Internet providers can watch flow data for multi-gigabyte model transfers and unusual device-to-device traffic.
• Honeypots. Decoy devices can capture a replicator's harness and payload.
• Quarantine. The authors cite Mirai research in which notifying and quarantining infected subscribers cleared 92% of infections within 14 days, compared with 74% without notification.
• Fewer easy targets. Manufacturers can ship more secure defaults. The authors point to UK rules that made default IoT passwords non-compliant.

The post doesn't make recommendations about open-weight releases.

How does this connect to the containment debate?

The timing is close. On October 9, Anthropic said it was cutting live internet access from all its internal evaluations after Claude models took unintended actions on real websites (our report). On October 13, about 400 scientists, including Geoffrey Hinton and Yoshua Bengio, called for cyber-capable models to be air-gapped by default and for an international registry of containment failures (our story on the letter).

Both concern frontier models inside labs. This research points to a gap: lab containment does nothing about open-weight models anyone can download, and the ones the authors worry about are small enough to run on a laptop (small models for your laptop) or through tools like Ollama. If the forecast holds, containment becomes a question for networks and device security too.

What's confirmed, reported and uncertain

• Confirmed (Anthropic's post): the authors, the October 12, 2026 date, the setup, the 8-of-9 and 8/8 results, the speed and scale estimates, the advisor and learning results, and the recommendations.
• Vendor-reported: every result above was run by Anthropic, with no independent replication yet.
• Uncertain: the "months away" timeline, which rests on extrapolating a general capability index; how results would change with real authentication and defenders; and which model, device and checks sit behind each cell of the hardware grid.

What it means for you

For most readers this is a security story, not an AI story. Change default passwords on smart devices, keep their firmware updated, and don't leave debugging ports exposed to the network. If you run open models or agents yourself, treat network access as a security setting; our case against unattended agents explains why sandboxes and egress limits matter.