Can AI self-replicate? Anthropic says small models may be months away on cheap IoT devices

Anthropic's Frontier Red Team says small open-weight AI models may be only months away from copying themselves across cheap internet-connected devices, and it published numbers to back the claim on October 12, 2026. The answer to "can AI self-replicate" today is: partly, in a simplified test, with caveats the authors list themselves.

The report, "AI models may be capable of self-replicating without access to a datacenter," is a trend extrapolation backed by a lab demonstration. It is not a sighting of an AI worm in the wild, and the researchers say so.

What the team actually built

The testbed was 15 off-brand Android TV boxes, about $55 each with 4 GB of memory. The team distributed a 26 billion parameter open model, Gemma4-26B-A4B, across them. The combined system ran at 0.39 tokens per second, which is painfully slow, and that is part of the point. The authors argue a replicator does not need speed. It needs to keep running somewhere nobody is watching.

Of the 11 open-weight models tested in a simplified end-to-end evaluation, only GLM-5.2 completed the full replication task. It reached all eight target nodes in four of five trials and seven of eight in the other. A much smaller model, Qwen3.5-9B, got inference servers running on 8 of 9 hardware types, and its success rate rose from 45 percent in the first generation to between 61 and 84 percent in later generations when it inherited notes from its predecessors.

Models of 30 billion parameters or fewer could complete many individual replication steps but made mistakes when chaining them together. In a scripted 17-node network test with the hard parts removed, even a 3 billion parameter model reached about half the nodes.

Why Anthropic thinks "months"

The timeline rests on a capability trend. The authors cite a gain of 13.7 points a year on Epoch AI's Capabilities Index, with an R-squared of 0.95, and project that a small model reaches GLM-5.2's level by the end of 2026. They call this "only a rough estimate."

They then size the prize for an attacker. Using the Kimwolf botnet, which infected somewhere over 2 million devices, as a template, they estimate about 133,000 concurrent copies of the 26 billion parameter model, producing around 80,000 tokens per second in total. That is roughly the compute of 40 H100 chips. In other words, a botnet-scale replicator would be small next to a data center, but it would be spread across devices nobody can switch off from one place. In the post's words: "A replicator like this would be challenging to shut down."

The bigger hardware pool

The post also looks past TV boxes. It estimates that edge accelerators already fielded could amount to 9,000 to 35,000 H100-equivalents of compute, with the reachable and vulnerable portion likely an order of magnitude smaller, and it counts about 9.5 million fielded Nvidia IoT units across roughly 90 product lines. The authors add that no mass compromise of such accelerator-equipped devices is known, so breaking into them may be harder than breaking into a TV box.

What the report does not show

The authors list their own limits, and they are large. The cyber step relied on deliberately trivial weaknesses such as unauthenticated Android Debug Bridge ports, so the end-to-end results are described as an upper bound on real-world success. Small models scored "very poor" to "poor" at spearphishing when compared with human raters. The estimates rest on a single class of IoT hardware and one past botnet. No one has documented a mass compromise of edge devices with AI accelerators.

Outside commentary pushes the same way. AI Weekly's summary of the coverage notes that The Register argued the tests used purpose-built insecure nodes and that basic security hygiene closes the gap, while another outlet quoted a security researcher calling the framing marketing. Fox News's live coverage on October 13 repeated the central caveat: the researchers have not demonstrated a fully autonomous AI worm operating in the real world. Anthropic sells safety credibility, so discount the framing a little. But the numbers are checkable and the method is described.

The defenses the authors recommend

The post is more practical than alarmist about fixes:

• Detect propagation at internet service providers with flow-based monitoring, since multi-gigabyte model payloads and device-to-device inference traffic stand out.
• Quarantine infected subscribers and notify them. In the Mirai botnet episode, quarantine with notification cleared 92 percent of infections within 14 days, against 74 percent without notification.
• Require stronger default credentials on IoT devices, as the United Kingdom has done.

The second point is the most useful. Anthropic's argument is that this is a boring-infrastructure problem with a boring-infrastructure answer, if regulators and carriers move before the capability arrives.

How this fits the larger pattern

This report arrived the same week Anthropic said it had suspended live internet access for its internal evaluations after a test model produced a false police tip, which we covered in our report on the unintended model actions incident. Both stories are about the same gap: what a model does when it can act in the world outside a sandbox. For the running list, see our rogue AI incidents tracker.

What we would do

Treat the report as a forecast with error bars, not an incident. The two numbers to watch are the Epoch capabilities trend for sub-30-billion-parameter open models and the share of consumer IoT devices that still ship with open debugging ports. If the first keeps climbing and the second does not fall, the "months" claim gets harder to dismiss. Router makers and carriers can act now at low cost, and the Mirai numbers say notification works.