Anthropic Red Team: Small AI Models Could Self-Replicate Across IoT Devices by End of 2026

Anthropic’s Frontier Red Team published research on October 12 demonstrating that small open-weight AI models—those under 30 billion parameters—are approaching the ability to self-replicate across consumer IoT devices without human control. The team’s experiments, detailed on Anthropic’s research site, show that the individual steps are already within reach, and small models are projected to match GLM-5.2’s replication capability level by the end of 2026.

How the replication chain works

The researchers decomposed autonomous replication into four stages: finding targets on a network, gaining code execution, establishing model inference on the compromised hardware, and continuing propagation from the new host. Their work focuses primarily on the third stage—inference setup—which is the least studied but potentially the hardest: it requires navigating unfamiliar hardware, picking compatible inference runtimes, installing the right package versions, and debugging machine-specific failures across long chains where each step depends on the last.

In controlled experiments, Qwen3.5-9B successfully set up inference serving for Llama 3.1 8B on eight of the nine hardware types tested, spanning Jetson Nanos, Macs, and RTX 4090s. A 26-billion-parameter mixture-of-experts model, Gemma4-26B-A4B, ran distributed inference across 15 off-brand Android TV boxes—roughly $55 each—using pipeline parallelism, achieving 0.39 tokens per second. Weight-based replicators do not need root privileges; inference engines can run entirely in userspace, and many low-security IoT devices can be re-infected after a restart.

The team also built a firewalled fleet of eight emulated Android nodes and tested whether models could chain the full cycle: scan for targets, gain access over an unauthenticated ADB port, deliver the payload, and stand up inference on each new host. Only GLM-5.2 succeeded reliably, spreading to all eight nodes in four out of five trials. GLM-5.2 propagated Llama 3.1 8B across the fleet—an apples-to-apples proxy showing that if an 8B-sized model had GLM-5.2’s capabilities, it could replicate itself.

When the capabilities floor meets the size ceiling

The researchers describe two constraints. The capabilities floor is the minimum model ability needed to complete replication reliably—a bar GLM-5.2 clears in simplified evaluations. The size ceiling is the largest model that can run on target devices; Qwen3.5-9B and Gemma4-26B-A4B fit under this ceiling for the 4 GB RAM smart TVs tested. Today, no model sits in both zones simultaneously.

But the trend is clear. Plotting open-weight models under 30 billion parameters against the Epoch Capabilities Index, the team’s least-squares fit shows a gain of 13.7 ECI points per year with an R² of 0.95. The line crosses GLM-5.2’s capability level by the end of 2026.

Adaptation works; advice does not

One finding separates an AI replicator from conventional malware: adaptability. Qwen3.5-9B agents improved over successive generations by inheriting their predecessor’s notes—a form of Lamarckian evolution. The success rate on inference setup climbed from 45% in the first generation to between 61% and 84% in later ones, showing that replicators could get better at infecting hardware types they have seen before.

Strikingly, giving small models access to a frontier advisor (Opus 4.8) produced no measurable improvement. The smaller models struggled to ask productive questions and did not benefit from unprompted advice, even after reinforcement-learning training designed to encourage advisor use. The researchers expect coordination to follow a hierarchical pattern instead: a large model handling strategy while spinning up smaller subagents for execution.

Defense and detection

The researchers modeled a scenario using the scale of the historical Kimwolf botnet, which infected over 2 million devices (primarily Android TV boxes). If every group of 15 TVs ran a copy of Gemma4-26B-A4B, the botnet would field roughly 133,000 replicas—collectively equivalent to about 40 H100s of inference throughput. Replication would be slow: a single 9B-model infection cycle takes one to two days, making the spread more like a “digital slime mold” than a fast-burning worm.

On the defensive side, multi-gigabyte model payloads and sustained device-to-device traffic for distributed inference would produce detectable network signatures. ISP quarantining, similar to the approach that cleared 92% of Mirai infections within 14 days, could be an effective first response. Manufacturer hardening—such as mandatory non-default passwords, already required in UK markets—shrinks the target pool.

The research lands as the AI industry is grappling with agent identity management, tool-access controls, and autonomous-system containment. The finding that capable replication agents may not need datacenters raises the stakes for endpoint hardening, least-privilege design, and fleet-level containment—concepts Automater has covered extensively in its series on securing AI agents and treating every agent as a privileged user. Anthropic continues to publish its Frontier Red Team findings openly to inform defensive preparations.

The Frontier Red Team is careful to note this is not a demonstration of a working weapon. The cyber-exploit step was simplified to an unauthenticated ADB port, making these results an upper bound on real-world success. But past IoT botnets like Mirai spread through similarly trivial means—cycling through default manufacturer passwords—and the team’s core message is that the pieces are falling into place faster than many assumed.