# Anthropic Red Team: Small AI Models May Be Months From Self-Replicating Across Cheap IoT Devices

Times of AI Desk · 2026-10-13 · Security

[https://timesof.ai/2026/10/anthropic-frontier-red-team-self-replicating-ai-iot-devices](https://timesof.ai/2026/10/anthropic-frontier-red-team-self-replicating-ai-iot-devices)

> In an Oct. 12 post, Anthropic's Frontier Red Team says small models may be months from being able to copy themselves onto poorly secured devices like Android TV boxes. It ran a 26B model across 15 TV boxes and, in a sandbox with a deliberately trivial entry point, saw GLM-5.2 replicate across eight nodes. No full rogue replicator exists, Anthropic says; it proposes ISP monitoring, quarantine and safer device defaults.

Anthropic's Frontier Red Team has put a rough timeline on the risk of AI that copies itself onto cheap, badly secured devices and keeps running where no one can switch it off centrally. In a research post dated **October 12**, William Zhou and Daniel Freeman write that "small AI models may be months away from being capable enough to self-replicate" on commercial internet-of-things devices such as smart ovens and off-brand Android TV boxes. They are explicit that this has not happened: "We don't yet have a full rogue replicator."

## What they showed

- **Running on cheap hardware:** a 9B model got inference running on 8 of the 9 hardware types tested. The team ran **Gemma4-26B-A4B** split across **15 off-brand Android TV boxes** (about $55 each, 4GB of RAM) at **0.39 tokens per second**.
- **Spreading in a sandbox:** in a firewalled cloud network of eight Android-emulator nodes, the "worm" hopped node to node over an unauthenticated debugging port and stood up a small model, Llama3.1-8B, on each target. Only **GLM-5.2**, among the open-weight models tested, completed end-to-end replication reliably: 8 of 8 nodes in four of five trials and 7 of 8 in the fifth.
- **Learning across copies:** when successive Qwen3.5-9B instances inherited notes from earlier attempts, inference-setup success rose from 45% in the first generation to between 61% and 84% later.

## The caveats Anthropic attaches

The break-in step was trivial by design, since the port had no authentication, which Anthropic calls "an upper bound on real-world success." GLM-5.2 itself was not running on the targets; the test asks whether a small model with GLM-5.2's competence could replicate. And the timeline is an extrapolation: plotting open-weight models of 30B parameters or fewer, the authors say the trend reaches GLM-5.2's level "by the end of 2026," with small replicators "possible soon after." Such a replicator would be slow, with a doubling time of days; The Verge highlights the post's comparison to a "digital slime mold."

## What they propose

Anthropic points to defences that worked against earlier botnets. A replicator moving multi-gigabyte model files between devices would show up in ISP flow monitoring, and quarantining infected subscribers cleared 92% of Mirai infections within 14 days in one case, it says. Manufacturers can also shrink the pool of targets with more secure defaults; the post notes default IoT passwords are already non-compliant in the UK.

The post follows Anthropic's September red-team report on [GLM-5.3's exploit-building ability](https://timesof.ai/2026/09/anthropic-glm-5-3-open-weight-cyber-safeguards), and lands the same day the UK's AI minister said an AI-driven breach of British defences was "likely, if not inevitable."

## Limits

- All results are Anthropic's own experiments; none has been independently replicated.
- The year-end estimate rests on a general capability index (ECI) that the authors call only a proxy for replication ability.
- The Verge item was a short post; we use it only for its framing.

## Sources

- [Anthropic: AI models may be capable of self-replicating without access to a datacenter (October 12, 2026)](https://www.anthropic.com/research/self-replicating-ai)
- [The Verge: Anthropic's Frontier Red Team suggests some AI models 'may be months away from being capable enough to self-replicate' (October 12, 2026)](https://www.theverge.com/ai-artificial-intelligence/1009658/anthropic-self-propagating-ai-slime-mold-botnets)
- [Times of AI: Anthropic Red Team: Open-Weight GLM-5.3 Nearly Matches Mythos Preview on Exploit Building](https://timesof.ai/2026/09/anthropic-glm-5-3-open-weight-cyber-safeguards)