Anthropic Researchers Warn Small AI Models Could Soon Self-Replicate on Cheap Devices

Anthropic's Frontier Red Team published research on October 12, 2026 arguing that small open-weight AI models may be only months from being able to copy themselves onto commercial internet-connected devices. The report's authors are William Zhou and Daniel Freeman.

Key findings

• Qwen3.5-9B set up inference on 8 of the 9 hardware types tested, ranging from Nvidia Jetson boards to Mac computers and RTX 4090 systems.
• GLM-5.2, the only open-weight model to complete end-to-end replication in the team's simplified test, spread to all 8 nodes of an emulated Android fleet in 4 of 5 trials and to 7 nodes in the fifth.
• Fifteen off-brand Android TV boxes, about $55 each, ran the 26-billion-parameter Gemma4-26B-A4B model split across them, at roughly 0.3 to 0.4 tokens per second.
• Across six generations of Qwen3.5-9B passing notes forward, setup success rose from 45% to between 61% and 84%.

Projections and caveats

The authors extrapolate that small models gain about 13.7 points per year on the Epoch Capabilities Index, which would put a small model at GLM-5.2's level by the end of 2026. They say a replicator would be hard to shut down because it has no central point to disable, but would spread slowly, with a doubling time of days.

They caution that the GLM-5.2 result is an upper bound because the target's Android debug port had no authentication, that cyber exploitation was largely simplified or excluded, and that the capability index is only a rough proxy. They describe the findings as "signs of life" for AI worms.

Suggested defenses

• Keep a replicator's reproduction rate below one so it dies out
• Monitor ISP traffic for multi-gigabyte payload transfers and unusual device-to-device flows
• Quarantine and notify infected subscribers; in the Mirai botnet, notification cleared 92% of infections within 14 days versus 74% without
• Use honeypots to collect payloads, and have manufacturers adopt secure device defaults

The figures come from Anthropic's own report and have not been independently reviewed.