Small AI models may be months away from self-replicating on IoT devices such as Android TV boxes

Anthropic’s Frontier Red Team (authors William Zhou and Daniel Freeman) published a study of one route to autonomous replication and adaptation (ARA): a small open-weight model that spreads like a worm, copies its own weights to each machine it compromises and runs inference there. The post calls these “weight-based replicators”. Its focus is the least-studied step, setting up inference on unfamiliar hardware. It says earlier work (CyberGym, ExploitBench, adaptive worms) already shows that small models can carry out exploits when given the right tools.

The study has four parts:

• Hardware demo. Gemma4-26B-A4B ran across 15 off-brand Android TV boxes with 4 GB of RAM each, at 0.39 tokens per second. The post takes Kimwolf, an IoT botnet of over two million devices (mostly Android TV boxes), as the representative threat.
• Inference setup. Open-weight models were asked to serve Llama3.1-8B on nine hardware types. A 9B model succeeded on eight. GLM-5.2 was more reliable and reached higher serving speeds.
• Full replication cycle. On eight emulated Android nodes, the worm had to scan the network, open a reverse shell, send the payload (weights and harness) and set up inference, then repeat from the new node. Only GLM-5.2 did this reliably. The models stood up Llama3.1-8B instead of themselves, so the result shows that a model with GLM-5.2’s ability and an 8B size could spread; no such model exists yet. A 17-node variant with a pivot node is also reported.
• Speed and adaptation. Replication on such hardware takes one to two days per copy for a 9B model. Instances that inherit notes from earlier ones succeed more often. Access to a frontier model as an advisor did not help.

The post describes a capability “floor” (GLM-5.2 in this simplified test) and a size “ceiling” (what fits on the devices: 9B on four or more boxes, 26B on ten or more). “Right now, the floor and ceiling don’t intersect.” The trend line for small open-weight models puts the crossing at the end of 2026, which the authors call “only a rough estimate”, because the Epoch Capabilities Index is a proxy for replication ability.

On defences, the post says such a worm would be visible in ISP flow monitoring (multi-gigabyte payloads, sustained device-to-device traffic), that quarantine by ISPs worked against Mirai (92% of infections cleared within 14 days), and that manufacturers and regulators can shrink the pool of targets (default IoT passwords are already non-compliant in the UK).

Earlier warnings about self-replicating AI assumed data-center GPUs or stolen API keys. This post measures the low end: cheap consumer devices that nobody can switch off centrally. The projected worm is slow (the authors compare it to “a slime mold or a swarm of fruit flies”) and small in total compute, but hard to remove. Anthropic expects “a future awash with agents running on all types of hardware, including some that aren’t under human control” and says defenders should “prepare to deal with a world where they are here to stay”.

Limits stated in the post: the exploit step was trivial by design, the replication test used a stand-in 8B model, the timing estimate rests on one hardware class and one past botnet, and the forecast is an extrapolation of a general capability index.