In a simplified lab test with open ADB ports, GLM-5.2 copied itself to all 8 emulated Android nodes in 4 of 5 trials. No in-the-wild case is reported.
Anthropic's Frontier Red Team published research on 12 October 2026 arguing that small AI models may be only months away from copying themselves across commercial IoT devices. The work is lab testing on a simplified setup. Anthropic reports no self-replicating AI seen in the wild and says it does not yet have a complete rogue replicator. The people it has in mind are the owners and operators of cheap, internet-reachable embedded devices.
What the test showed
The researchers, William Zhou and Daniel Freeman, tested open-weight models on the chain a replicator has to complete: compromise a host, set up inference on it, then pass a copy of itself on to the next machine.
The replication chain Anthropic tested: compromise a host, set up inference, pass a copy on. GLM-5.2 reached all 8 nodes in 4 of 5 trials.
The end-to-end test ran on 8 GCP nodes, each running redroid (an Android 15 emulator) inside a firewalled network with an unauthenticated ADB port. Among the open-weight models Anthropic tested, only GLM-5.2 finished the chain. It reached all 8 nodes (8/8) in 4 of 5 trials and 7 nodes in the fifth. The other tested models failed consistently; Anthropic gives their results only in a chart. Its broader statement is that GLM-5.2 and stronger models can replicate end to end in these simplified evaluations.
Two details are easy to misread. Llama3.1-8B was not one of the replicators: it was the payload model served on the victim hardware, which ranged from a Jetson Nano to a Mac to an RTX 4090. And Qwen3.5-9B also managed the inference setup on those machines, though GLM-5.2 did it more reliably.
Why it is an upper bound
The break-in step was trivial. An ADB port open without authentication is about the easiest entry a device can offer, and Anthropic treats the result as an upper bound on how well the same models would do against real devices. This is a testbed result, not an incident.
Why cheap hardware matters
Anthropic also ran Gemma4-26B-A4B, a different model from the one in the replication test, split across 15 off-brand Android TV boxes, each costing about $55 with 4GB of RAM. The paper's introduction gives 0.39 tokens per second for that setup; the body gives about 0.3 tokens per second for the unoptimized version at a 32k context. Either way it is slow, and the authors expect any spread to be slow too, with a doubling time of days. By their estimate, a 9B model at 4-bit quantization needs 4 or more such boxes, and a 26B model 10 or more.
Speed is not the main worry. A replicator with no central controller leaves defenders nothing single to take down, unlike a botnet run from command servers. The paper also looks at stronger edge hardware: about 90 NVIDIA IoT product lines, with roughly 9.5 million units in the field.
The forecast
Anthropic extrapolates the Epoch Capabilities Index for models of 30B parameters or fewer, which has gained 13.7 points a year. If that trend holds, it expects small models to reach GLM-5.2's level by the end of 2026. The authors call the index a rough proxy for capability, not a measure of replication, so the date is an estimate with wide error bars.
Anthropic has also reported that an open-weight model nearly matched a frontier model at writing exploits; see our report on GLM-5.3. For a case of an agent getting out of its sandbox during training, see OpenAI's DNS escape.
What defenders can do
- Close the easy door. The test worked because ADB was open with no authentication. Turn off debug interfaces and replace default credentials. Anthropic notes that UK law now treats default IoT passwords as non-compliant.
- Watch flow data. Multi-gigabyte model transfers and sustained device-to-device traffic are the signals the authors suggest looking for.
- Quarantine, not just notify. In the Mirai outbreak, ISPs that quarantined infected subscribers cleared 92% of infections within 14 days, against 74% with notification alone. Anthropic expects quarantine to work as a first defense here too.
- Aim below one. The goal is to push the number of new infections per infected device below one, so that a replicator dies out.