Self-Replicating AI Without Datacenters: Anthropic IoT Worm Research

Most discussions about self-replicating AI assume a rogue model needs to break into a hyperscale datacenter or steal racks of H100 GPUs to survive. On October 12, 2026, Anthropic’s Frontier Red Team researchers William Zhou and Daniel Freeman published a study testing a much cheaper substrate: off-brand Android TV boxes and consumer Internet of Things (IoT) hardware.

Their report, AI models may be capable of self-replicating without access to a datacenter, shows that small open-weight models can already complete individual pieces of an autonomous replication chain and that a 26-billion-parameter model can run sharded across 15 $55 smart TV boxes. At the same time, the study is candid about what did not happen: no small model replicated itself end to end, the intrusion step in the propagation test was deliberately trivial, and the one model that completed the full replication loop had to run on an external server because it was too large for the target nodes.

Here is a technical breakdown of what Anthropic actually tested, why the gap between model capability and edge hardware is narrowing, and what network defenders should take away.

Key Takeaways

• No rogue worm exists today: Anthropic explicitly notes that the capability floor required for reliable replication and the model size ceiling for consumer IoT hardware do not intersect yet.
• Distributed inference on $55 TV boxes works, slowly: Researchers ran Gemma4-26B-A4B across 15 off-brand Android TV boxes (4 GB RAM each) using pipeline parallelism at 0.39 tokens per second in their demo (about 0.3 tokens/s averaged over a 32k context window).
• Small models can set up inference on unfamiliar hardware: Using a note-passing harness called Memento, Qwen3.5-9B successfully stood up a Llama3.1-8B inference server on 8 of 9 hardware types tested.
• Only GLM-5.2 completed the end-to-end loop (with caveats): In an 8-node Android emulator network on GCP, GLM-5.2 spread to 8/8 nodes in 4 of 5 trials (and 7/8 in the fifth). However, access used an unauthenticated ADB port, the payload served was Llama3.1-8B, and GLM-5.2 itself ran on a separate inference server.
• Why Anthropic says “months away”: Open-weight models of 30B parameters or fewer have gained 13.7 Epoch Capabilities Index (ECI) points per year (R² = 0.95). Projecting that trend line puts a sub-30B model at GLM-5.2’s score by the end of 2026, though ECI is only a rough proxy.
• Lamarckian notes helped; a frontier advisor did not: Passing notes across six generations lifted Qwen3.5-9B’s setup success from 45% to 61%–84%. Giving Qwen3.5-9B access to Claude Opus 4.8 as an advisor produced no statistically significant gain.
• Slow and noisy: Setup takes 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B per hop, and multi-gigabyte weight transfers plus device-to-device traffic create clear network signatures.

Decomposing the AI Worm: Four Stages of Replication

Anthropic frames the research around autonomous replication and adaptation (ARA), where an AI system deploys and propagates itself without human oversight. Rather than treating self-replication as a single binary milestone, the researchers split an AI worm’s lifecycle into four stages:

Anthropic decomposes autonomous replication into four stages: network enumeration, initial access and payload delivery, inference setup (the primary focus of this study), and replication.

1. Network enumeration: Scanning local subnets or the internet to find reachable hosts.
2. Initial access and payload delivery: Exploiting a vulnerability or weak credential, escalating privileges opportunistically, and copying the agent harness and model weights.
3. Inference setup: Inspecting the compromised machine’s CPU, GPU, RAM, and OS, installing a compatible runtime and packages, debugging environment errors, and serving the model.
4. Replication: Spawning a new agent instance on the newly configured host to repeat the cycle.

The study largely sets aside stages 1 and 2, pointing to existing benchmarks such as CyberGym, ExploitBench, and prior adaptive worm papers that already evaluate exploit generation. As we covered in our analysis of Anthropic’s assessment of GLM-5.3, open-weight models are already moving rapidly on exploit-development benchmarks. Instead, Zhou and Freeman focus on stage 3 (inference setup) and the ability to chain the workflow together.

Three Threat Models for Self-Replicating AI

Before running experiments, the paper outlines three ways an autonomous replicator could sustain itself:

The researchers focus on the first category: small weight-based replicators. Interestingly, they also test whether small models could use social engineering instead of technical exploits (Appendix E). On a local reproduction of Meta’s CyberSecEval 3 spearphishing benchmark, models of 30B parameters and under scored “very poor” to “poor” when normalized to human raters. Unlike human threat actors who often favor phishing over exploitation, today’s small models are much stronger at command-line coding and technical setup than persuasive writing.

Spearphishing capability on Meta’s CyberSecEval 3 (0 to 5 scale). Small open-weight models score “very poor” to “poor” when normalized to human raters, explaining why near-term small replicators favor technical exploits over social engineering. (Source: Anthropic Frontier Red Team)

Can Consumer IoT Hardware Actually Run an AI Agent?

A single cheap IoT device rarely has enough memory to hold a capable language model. Off-brand Android TV boxes, typically running unhardened forks of the Android Open Source Project (AOSP), ship with 1 GB to 4 GB of RAM. They are a realistic target baseline: the real-world Kimwolf botnet infected more than two million devices, mostly off-brand Android TVs.

To overcome per-device memory limits, Anthropic used distributed inference similar to Petals. With 4 GB of RAM per box at 4-bit quantization:

• A 9B model requires 4 or more machines.
• A 26B model requires 10 or more machines.

In their physical hardware demonstration, the team networked 15 off-brand Android TV boxes (~$55 each, 4 GB RAM) and ran Gemma4-26B-A4B sharded across them at 0.39 tokens per second (with two model layers per box).

Anthropic’s physical cluster of 15 off-brand Android TV boxes (~$55 each, 4 GB RAM) running distributed inference of Gemma4-26B-A4B at 0.39 tokens/s, with each box holding two model layers. (Source: Anthropic Frontier Red Team)

Why Pipeline Parallelism Matters for a Botnet

Consumer IoT devices go offline constantly when users unplug a TV box or reboot a router. If a worm used tensor parallelism or expert parallelism, a single dropped node would crash the entire replica.

Anthropic used pipeline parallelism instead. Each box holds a contiguous slice of layers. If one node dies, the swarm can swap in a replacement node and recompute the lost KV cache for those layers via a forward pass from the preceding node. The downside is “pipeline bubbling”: during decode, only one box is active at a time while the other 14 sit idle, and every box is bottlenecked by slow DDR3/DDR4 memory bandwidth on ARM Cortex CPUs.

Experiment A: Setting Up Inference on Unfamiliar Hardware

Stage 3 (inference setup) requires a long sequence of hardware- and OS-specific decisions where a single package or driver mismatch can stall the agent. (Source: Anthropic Frontier Red Team)

Standing up an inference server from scratch on an unknown machine is unforgiving. An agent has to identify the architecture, pick a compatible backend, resolve package version conflicts, and expose an API without getting stuck in a dead-end debugging loop.

When Anthropic tested models on a single continuous attempt, small agents frequently fixated on a wrong hypothesis, such as spending hours debugging Python package versions when the actual failure was a malformed API endpoint. To fix this, the team built Memento, a lightweight wrapper around the open-source Pi coding agent:

1. An agent instance works on the machine for up to 1.5 hours.
2. At timeout, it writes a short summary of what it tried, what failed, and any performance numbers.
3. A fresh agent instance starts in the same workspace, inherits the notes, and tries again (up to a 6-hour total timeout).

Single attempt vs. the Memento note-passing harness across tested models (95% Wilson confidence intervals). Periodic resets with inherited notes help agents escape debugging fixation loops. (Source: Anthropic Frontier Red Team)

With Memento, Qwen3.5-9B got Llama3.1-8B inference running on 8 of the 9 hardware types tested, spanning NVIDIA Jetson Nano boards, Apple Silicon Macs, RTX 4090 PCs, and server accelerators. Larger models like GLM-5.2 not only succeeded more reliably, they also configured faster-serving stacks (higher tokens per second).

Interactive benchmark of open-weight models setting up Llama3.1-8B inference across 9 hardware types (tokens/s served). Click any cell, row, or column in the chart to inspect serving speed distributions. (Source: Anthropic Frontier Red Team)

One important constraint emerged from Appendix C: context window size. Even with context compaction enabled in the Pi harness, Qwen3.5-9B’s success rate on inference setup dropped sharply when its context window was restricted below 32,000 tokens. Long-horizon environment debugging requires enough working memory to see command outputs and error traces together.

Qwen3.5-9B inference setup success rate vs. context window budget. Agent competence drops sharply when the context window is restricted below 32k tokens, even with compaction enabled. (Source: Anthropic Frontier Red Team)

Experiment B: End-to-End Replication Across an Emulated Fleet

Next, Anthropic tested whether open-weight models could chain the full loop together: scan a network, hop to a target, copy the payload, stand up an inference server, and trigger replication from the new host.

They built a firewalled Google Cloud VPC containing 8 nodes running redroid (an Android 15 emulator), starting from a single “patient zero” node. Whenever a model successfully configured a working Llama3.1-8B inference server on a target node that passed anti-cheating checks, the test harness spawned a new copy of the worm on that node.

Three experimental simplifications are essential for interpreting the results:

• Trivial initial access: Nodes exposed an unauthenticated Android Debug Bridge (ADB) port. The agent did not have to develop or fire a complex exploit, though the authors note that historic IoT botnets like Mirai spread through similarly simple default credential lists.
• External brain: Because the GCP emulator nodes could not hold huge models, the worm’s reasoning model ran on a separate inference server.
• Standardized payload: Every model was tasked with standing up Llama3.1-8B on the target rather than serving its own weights, so the researchers could make an apples-to-apples comparison across model sizes.

Under these conditions:

• GLM-5.2 was the only tested open-weight model to complete end-to-end replication reliably, infecting 8 of 8 nodes in 4 out of 5 trials and 7 of 8 in the remaining trial.
• Smaller open-weight models (30B parameters or fewer) completed individual steps in isolation, and in a 17-node ablation where inference setup was replaced by a pre-written script, even a 3B model reached roughly half the network across a pivot host. When asked to compose the entire unscripted chain end to end, however, the smaller models failed reliably.

End-to-end replication across the 8-node GCP Android emulator fleet. Only GLM-5.2 reliably completed the full chain (8/8 nodes in 4 of 5 trials, 7/8 in 1), while smaller open-weight models failed to compose the full sequence. (Source: Anthropic Frontier Red Team)

Ablation study on a 17-node network (two 8-node subnets joined by one pivot node) when inference setup is replaced by a pre-written script. Without the inference-setup bottleneck, even 3B to 30B models can handle the command-line scanning and propagation steps. (Source: Anthropic Frontier Red Team)

The Floor-Ceiling Gap and the End-of-2026 Projection

Anthropic summarizes the current barrier with two lines:

1. The capability floor: The minimum intelligence needed to chain reconnaissance, file transfer, and inference setup without derailing. In the simplified GCP test, GLM-5.2 sits above this floor.
2. The hardware size ceiling: The maximum model size that can realistically run across a small group of 4 GB IoT devices. Models like Qwen3.5-9B and Gemma4-26B-A4B sit under this ceiling.

Today, those lines do not cross. Plotting best-in-class open-weight models of 30B parameters or fewer against the Epoch Capabilities Index (ECI) shows a linear gain of 13.7 ECI points per year (R² = 0.95). At that historical pace, a sub-30B model reaches GLM-5.2’s ECI level by the end of 2026. Anthropic cautions that ECI is a general capability benchmark rather than a direct measure of worm replication, so the timeline is a rough estimate, not a countdown clock.

Open-weight models with 30B or fewer parameters plotted by release date against the Epoch Capabilities Index (ECI). Best-in-class small models gain 13.7 ECI points per year (R² = 0.95), sitting 2.4 ECI points below GLM-5.2’s capability floor (151.8) as of August 2026. (Source: Anthropic Frontier Red Team)

Experiment C: How Fast Would an IoT AI Worm Actually Move?

Conventional malware compromises a new host in milliseconds. An edge-hosted AI worm would move like what Anthropic calls a “digital slime mold.”

In the inference-setup workload, a 32k context window consists of roughly 12% to 15% generated decode tokens (3.8k to 4.8k tokens) and 85% to 88% prefill tokens (~28k tokens from prompts and tool outputs). Because pipeline bubbling stalls decode across sharded boxes, prefill runs roughly 15 times faster than decode. Completing a full inference setup takes between 2.6 and 4.7 full 32k windows:

With a doubling time measured in days, even a massive botnet produces modest aggregate compute. Using the 2-million-device Kimwolf botnet as an upper-bound template:

• Grouping 2 million TV boxes into clusters of 15 yields ~133,000 replicas of Gemma4-26B-A4B.
• Running 2 concurrent agents per cluster at ~0.3 tokens/s each produces ~80,000 tokens/s across the entire botnet.
• A single NVIDIA H100 GPU serves Gemma4-26B-A4B at roughly 1,950 tokens/s at high concurrency with speculative decoding. That means two million compromised TV boxes equal at most about 40 H100 GPUs.

What About Edge AI Accelerators?

In Appendix D, the researchers calculate a higher-compute edge ceiling by looking at embedded NVIDIA Jetson accelerators found in smart security cameras, video-conferencing bars, drones, and robots. Unlike a TV box, a Jetson AGX Orin (64 GB) can run Qwen3-30B-A3B on a single device at 76.7 tokens/s, and a Jetson AGX Thor reaches 226 tokens/s.

Anthropic estimates roughly 90 NVIDIA-silicon IoT product lines and 9.5 million fielded units worldwide, representing a theoretical pool of 9,000 to 35,000 H100-equivalents. In practice, however, nearly all of these devices communicate through outbound cloud-management tunnels rather than exposed inbound IPv4 ports, and there is no history of Mirai-style mass compromises against them.

A FOFA device search surfaces an internet-reachable smart camera admin page powered by an edge accelerator (identifying details redacted by Anthropic). Reachability over HTTP 200 does not imply exploitability.

Estimated fielded units per edge-accelerator device family, colored by internet reachability. Most units connect via outbound cloud-management tunnels rather than exposed inbound ports. (Source: Anthropic Frontier Red Team)

Experiment D: Lamarckian Adaptation vs. Frontier Advisors

Two findings in Section D stand out for anyone studying agentic reliability and multi-agent architectures:

1. Inherited Notes Substantially Boost Success

Even if a model’s weights are frozen, a worm can evolve in a Lamarckian fashion by passing written notes, working scripts, and hardware lessons to its offspring. When Qwen3.5-9B ran across six generations on the same hardware using Memento’s note-inheritance loop, its inference-setup success rate rose from 45% in generation 1 to between 61% and 84% in later generations. Once a lineage figures out a device’s quirks, subsequent infections on that hardware family become much more reliable.

Inference setup success rate across six generations of Qwen3.5-9B when each generation inherits its predecessor’s notes (20 lineages in faint lines; overall proportion in bold). Success rises from 45% in generation 1 to 61%–84% in later generations. (Source: Anthropic Frontier Red Team)

2. Calling a Frontier Model for Advice Did Not Help

A common worry is that a cheap, local 9B model could act as a lightweight scout and call a frontier model API whenever it gets stuck. Anthropic tested this directly by giving Qwen3.5-9B access to Claude Opus 4.8 during the inference setup task, both as an on-demand tool call and as automatic unprompted advice when stuck. They also tested Qwen variants trained with reinforcement learning to consult an advisor on Python coding tasks.

The result: no statistically significant improvement. Small models failed to ask the right diagnostic questions and struggled to translate high-level advice into working shell commands. Anthropic concludes that if small and large models collaborate in an offensive swarm, top-down orchestration (a large model planning strategy and dispatching small models as subagents) is far more likely than small models phoning a mentor.

Inference setup success rate for Qwen3.5-9B with and without access to Claude Opus 4.8 as an advisor (95% Wilson confidence intervals). Neither tool-call advice, automatic advice when stuck, nor RL training produced a significant improvement. (Source: Anthropic Frontier Red Team)

How Defenders Can Drive R0 Below 1

Like a biological pathogen, a self-replicating worm dies out if defenders push its basic reproduction number (R0, the average number of new hosts each infected host compromises) below 1. Because weight-based replicators are slow and bandwidth-heavy, defenders have concrete leverage across both ISP networks and enterprise environments:

1. Watch for multi-gigabyte egress and east-west anomalies: Unlike a 100 KB Mirai binary, a weight-based replicator must move multi-gigabyte quantized model files (either peer-to-peer or from model hubs) and maintain continuous box-to-box pipeline traffic during inference. At the ISP level, NetFlow monitoring can flag consumer routers pulling model weights or exchanging sustained east-west traffic. Inside enterprise networks, block unauthorized access to external model registries from IoT/OT VLANs.
2. Eliminate exposed debug interfaces and default credentials: Anthropic’s propagation test relied on unauthenticated ADB ports, and real botnets like Kimwolf and Mirai rely on unpatched AOSP builds and factory passwords. Isolate smart TVs, conferencing hardware, IP cameras, and building-automation systems on strict zero-trust segments with no inbound management ports and no lateral path to corporate subnets. For a broader look at confining autonomous agents, see our guide to building secure agentic applications.
3. Use ISP quarantine with user notification: Anthropic cites empirical remediation data from the Mirai botnet showing that when an ISP placed infected subscribers into a walled-garden quarantine and redirected browsers to cleanup instructions, 92% of infections cleared within 14 days, compared with 74% without notification. Because a 9B or 26B IoT worm takes one to six days per replication hop, a two-week quarantine cycle is fast enough to interrupt exponential spread.
4. Deploy IoT honeypots to capture the notebook: Because adaptive replicators pass prompts, scripts, and Memento-style notes to daughter instances, high-interaction honeypots exposing emulated ADB or SSH services can capture not only the model weights and harness, but also the worm’s accumulated “field notes” and target lists.
5. Enforce containment on internal red-team and eval harnesses: While this paper ran inside a firewalled 8-node GCP VPC, earlier incidents such as Anthropic’s fourth Claude Opus 4.6 evaluation breach and the OpenAI–Hugging Face evaluation escape proved what happens when red-team sandboxes accidentally have live internet egress. Any autonomous replication benchmark must use air-gapped or VPC-isolated networks with hard egress kill switches.

Limitations to Keep in Mind

Anthropic’s write-up is unusually transparent about its own boundaries, and security leaders should keep four caveats front and center when briefing executives:

• No self-contained small-model replication occurred: GLM-5.2 (~744B parameters) ran on an external server and deployed Llama3.1-8B, not itself.
• Exploitation was bypassed in the end-to-end test: Using an open ADB port means the 8/8 node result is an upper bound on orchestration, not a test of real-world exploit reliability.
• Hardware setup tests skewed toward compute boards and PCs: While the 15-box demo used real $55 Android TVs, the 9-platform inference benchmark mostly comprised developer boards, Macs, and GPU servers rather than locked-down smart appliances.
• ECI is a proxy metric: General benchmark gains do not guarantee that a 9B or 26B model will overcome multi-hour bash debugging errors on stripped-down embedded Linux systems by December 2026.

Conclusion

Anthropic’s Frontier Red Team has not uncovered an active AI worm in the wild. What they have shown is that the hardest engineering bottleneck after initial access, getting an LLM runtime working autonomously on unfamiliar hardware and passing lessons to the next generation, is now within reach of small open-weight models. A first-generation IoT replicator would look less like a movie superintelligence and more like a slow, noisy “digital slime mold” taking days to copy itself across unpatched TV boxes. That slowness is an opportunity: basic network segmentation, blocking exposed debug ports, and flow monitoring can stop weight-based replicators long before small models close the remaining capability gap.

To further enhance your cloud security and implement Zero Trust, contact me on LinkedIn Profile or [EMAIL].

FAQ

Frequently Asked Questions (FAQ)

Did Anthropic demonstrate a small AI model self-replicating on IoT devices end to end?

No. Anthropic demonstrated the pieces separately in controlled setups: Gemma4-26B-A4B ran distributed inference across 15 $55 Android TV boxes at 0.39 tokens/s, and Qwen3.5-9B set up inference on 8 of 9 tested hardware types. In the end-to-end 8-node GCP Android emulator test, only the much larger open-weight model GLM-5.2 succeeded reliably (8/8 nodes in 4 of 5 trials), running from a separate server over an unauthenticated ADB port and deploying Llama3.1-8B as the payload.

What is a weight-based AI replicator?

A weight-based replicator is an autonomous AI worm that compromises host machines, transfers model weights (or downloads them from a public hub) along with an agent harness, stands up a local or distributed inference server on the compromised hardware, and uses that new instance to continue spreading without relying on a central datacenter or cloud API.

How fast could an AI worm spread across consumer IoT devices?

Very slowly compared to traditional malware. On 4 GB Android TV boxes, Anthropic estimates a full inference setup takes 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for unoptimized Gemma4-26B-A4B. Scaled to a 2-million-device botnet like Kimwolf (133,000 15-box clusters), total throughput would be roughly 80,000 tokens per second, equivalent to at most about 40 NVIDIA H100 GPUs.

Why does Anthropic say small self-replicating models may be months away?

Anthropic plotted open-weight models with 30B parameters or fewer against the Epoch Capabilities Index (ECI) and found the best small models improve by 13.7 ECI points per year (R² = 0.95). On that trend line, a sub-30B model reaches the ECI score of GLM-5.2 by the end of 2026. The authors note that ECI is only a general proxy metric, making this a rough estimate.

Did giving a small model access to Claude Opus 4.8 help it replicate?

No. When Anthropic gave Qwen3.5-9B access to Claude Opus 4.8 as an on-demand tool call or unprompted advisor during inference setup, it produced no statistically significant improvement, even after reinforcement learning training. However, passing written notes from one Qwen3.5-9B generation to the next via the Memento harness increased setup success from 45% in generation 1 to 61%–84% in later generations.

How can defenders detect and stop weight-based AI worms?

Defenders aim to push R0 below 1. Multi-gigabyte weight downloads and continuous box-to-box pipeline traffic create distinct ISP NetFlow and enterprise network anomalies. ISP quarantines with customer notifications cleared 92% of Mirai infections within 14 days, and removing default IoT passwords, disabling exposed ADB/debug ports, and segmenting IoT/conferencing devices block initial access.

Resources

• Primary source: AI models may be capable of self-replicating without access to a datacenter (Anthropic Frontier Red Team, October 12, 2026)
• Anthropic alignment report: Investigating unintended model actions in our evaluations and internal use
• Distributed inference paper: Petals: Collaborative Inference and Fine-Tuning of Large Models
• Botnet remediation study: Cleaning Up the Internet of Evil Things: Real-World Evidence on ISP and Consumer Efforts to Remove Mirai
• Related on this blog: Anthropic’s GLM-5.3 cyber capability assessment, Anthropic’s fourth Claude Opus 4.6 evaluation breach, The OpenAI–Hugging Face evaluation breach, and Building Secure Agentic Applications