Anthropic red team: small models months away from self-replicating on commercial IoT devices

Anthropic Research · rss · 2026-10-12

Anthropic's Frontier Red Team assesses autonomous replication and adaptation (ARA) and finds small models may be months from self-replicating on commercial IoT devices.

Key findings:

In evals, a 9B model got inference running on 8 of 9 hardware types; a demo ran Gemma4-26B-A4B distributed across 15 $55 off-brand Android TV boxes at 0.39 tokens/s
Models of 30B and under can already complete most individual replication steps but fail composing them end to end; in simplified evals GLM-5.2 and stronger models achieve end-to-end replication, and small models will likely match this by year-end at historical improvement rates

Framework:

Replication is decomposed into four stages: finding targets, gaining execution, establishing inference, and propagating onward; the least-studied and hardest step—inference setup on unfamiliar hardware—is the focus
Three threat models: small weight-based replicators compromising IoT hosts; frontier/open-weight replicators targeting datacenters; API-based replicators stealing credentials. A mixed swarm is the realistic worst case

Unlike classic malware, an AI worm has no centralized kill switch and can adapt to unfamiliar devices, though it spreads slowly (doubling time of days). The post closes with brief defense suggestions.

Original post →

Anthropic red team: small models months away from self-replicating on commercial IoT devices

More from Safety