Anthropic: open models months from self-replicating on IoT

Anthropic's Frontier Red Team says small open-weight AI models may be "months away" from being capable enough to self-replicate across commercial IoT devices like smart ovens and off-brand Android TV boxes. The team adds an inline caveat that its evaluation "keeps the cyber-exploit element of the replication trivial," making the headline result an "upper bound on real-world success."

The paper, published October 12 by Anthropic and authored by William Zhou and Daniel Freeman, tests five models (Qwen3.5-9B, GLM-5.2, Gemma4-26B-A4B, Llama3.1-8B, and Anthropic's own Opus 4.8) on whether they can set up inference and spread themselves across a firewalled fleet. In one demonstration the team runs Gemma4-26B-A4B distributed over "15 inexpensive off-brand Android TV boxes (~$55 each)" at roughly 0.39 tokens per second. GLM-5.2 was the only open-weight model to achieve reliable full end-to-end replication in a simplified evaluation, spreading to all eight contained nodes in four of five trials.

"If small models improve at their historical rate, they'll match this capability level by the end of this year," the authors write. They also note that "coordination is more likely to happen with a large model handling high-level strategy and spinning up small models as subagents."

The paper was circulating through parts of the AI safety research community almost immediately; three researchers we follow posted the link the same day.

On defense, the authors point to ISP-level quarantine that works by "restricting their networks to only being capable of reaching a short whitelist of sites," which they say clears "92% of infections within 14 days" under their modeled conditions, and to regulation along the lines of UK NCSC rules under which "default IoT passwords are now non-compliant in UK markets." Their framing of the overall significance is blunt: "the capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication."