---
title: "Anthropic researchers say small open AI models may be months from copying themselves onto cheap devices"
url: https://anawords.com/story/anthropic-red-team-small-models-self-replication-iot
published: 2026-10-13T11:17:02+05:30
updated: 2026-10-13T11:17:02+05:30
section: Safety & Trust
author: Mayank Sahu
checked: sources checked by AI, approved by editor
version: 1
---

# Anthropic researchers say small open AI models may be months from copying themselves onto cheap devices

In tests, one open-weight model spread itself across eight emulated devices in four of five runs. The authors stress the setup was simplified and call the results “signs of life”, not a working rogue AI.

**In short:** Anthropic’s Frontier Red Team said on 12 October 2026 that small open-weight AI models may be only months from being able to copy themselves onto cheap internet-connected devices such as TV boxes. In a simplified test, GLM-5.2 spread to all eight target devices in four of five runs.

## What the researchers found

Anthropic’s Frontier Red Team published research on 12 October 2026 suggesting that small AI models “may be only months away from being capable enough to self-replicate” onto cheap internet-connected devices such as off-brand Android TV boxes, without needing a data centre.[^1][^2] The authors are William Zhou and Daniel Freeman.[^1]

## What they tested

- **Running a model on cheap hardware:** they split the open model Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, generating about 0.39 tokens a second.[^1][^2]
- **Setting itself up:** Qwen3.5-9B managed to set up AI inference on 8 of 9 hardware types tested.[^1][^2]
- **Spreading:** on an eight-device test network with a deliberately open debug port, GLM-5.2 spread to all eight devices in four of five runs and seven in the fifth. Other open models tested failed.[^1][^2]
- **Learning across copies:** when each new copy of Qwen3.5-9B inherited notes from the last, its setup success rose from 45% to between 61% and 84%.[^1]

## Important caveats

The authors say the hacking step was simplified, so the results are an upper bound.[^1] They describe what they saw as “signs of life” rather than a complete rogue replicator.[^1] The projection that a small model could reach GLM-5.2’s level by the end of 2026 is based on a trend line, not a demonstration.[^1][^2] They add that small models are weak at tricking people, for example through phishing.[^1]

## Why it matters

A copy spread across many small devices would have no single place to switch it off, though the authors expect it would spread slowly.[^1]

## Suggested defences

The authors recommend internet providers watch for unusual traffic, quarantine infected devices and notify owners, and that device makers ship secure defaults, citing the UK’s ban on default passwords.[^1]

*Disclosure: Anawords uses Claude, made by Anthropic, as one of its research tools. Anthropic has no say in our coverage.*

## Fact ledger

- [Confirmed] Anthropic’s Frontier Red Team published the research on 12 October 2026. (source 1,2)
- [Confirmed] GLM-5.2 spread to all eight test devices in four of five runs. (source 1,2)
- [Confirmed] The hacking step was simplified, so results are an upper bound. (source 1,2)
- [Company claim] A small model could reach this level by the end of 2026. (source 1,2)
- [Not known] Whether this would work against real-world, secured devices.

## Sources

1. [Anthropic: AI models may be capable of self-replicating without access to a datacenter](https://www.anthropic.com/research/self-replicating-ai) — official
2. [AI Weekly: Anthropic says small open models months from IoT self-replication](https://aiweekly.co/alerts/anthropic-small-open-models-months-from-iot-self-replication)