Anthropic: Small Open Models Months From IoT Self-Replication
TL;DR
- Of 11 open-weight models tested, only GLM-5.2 completed end-to-end replication; Qwen3.5-9B reached 84% node installation but failed full propagation chaining.
- Replication cycles take 28 to 150 hours per node, making these worms slow but persistent with no single shutdown point once distributed.
- A Mirai-scale deployment of the 26B model delivers roughly 40 H100-equivalent compute, limiting utility to self-perpetuation rather than meaningful AI tasks.
"Small AI models may be months away from being capable enough to self-replicate on commercial IoT devices." That is the opening claim of a Frontier Red Team report published Monday by Anthropic researchers William Zhou and Daniel Freeman.
Only one open-weight model they tested cleared the full bar. "Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication," the paper states, with GLM-5.2 reaching all eight target nodes in four of five trials. Smaller models fell short of that but got close on the individual steps. Qwen3.5-9B set up inference on 8 of 9 hardware types the team threw at it, and its success rate climbed from 45% to between 61% and 84% as the agent inherited notes across generations.
The concrete detail: the team bought fifteen off-brand Android TV boxes at roughly $55 each, networked them together, and ran Gemma4-26B-A4B across the cluster at 0.39 tokens per second. As a reference for scale, the authors point at Kimwolf, the IoT botnet whose peak infection count sat "somewhere over 2 million" devices, primarily off-brand Android TVs. At that size, they estimate the pool could host around 133,000 concurrent copies of Gemma4-26B-A4B.
The methodology carries its own hedges. The cyber evaluation uses "trivial" elements such as unauthenticated ADB ports, the Edge Compute Index is "only a proxy metric for replication ability," and spear-phishing capability in the small models rated "very poor to poor." The projection is a trend extrapolation, not a demonstrated capability in a 9B-class model today.
Zhou and Freeman close on this: "We expect a future awash with agents running on all types of hardware, including some that aren't under human control."
What others are reporting
-
The Hacker News Read →
Details all three replication architectures (weight-based, orchestrator, API-relay) and reports 11 models tested, with GLM-5.2 the sole end-to-end success.
Such an 'AI worm' could carry its model weights with it as it reproduces...the weights would become part of the malware payload.
-
BleepingComputer Read →
Pins down setup timing (28-51h for Qwen3.5-9B, 71-150h for Gemma4-26B-A4B) and reports Qwen3.5-9B's 84% node-installation rate despite failing full replication.
Small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things devices.
-
SecurityWeek Read →
Quantifies botnet economics: a Mirai-scale deployment of the 26B model yields roughly 40 H100-equivalent compute, and large weight transfers produce detectable traffic.
Small weight-based replicators may be possible soon after.
-
The Register Read →
Only contrarian take from a tier-1 outlet: tests used purpose-built insecure nodes, only one of many models succeeded, and basic hygiene closes the gap.
A replicator like this would be challenging to shut down, since there's no centralized point to shut off.
-
Gizmodo Read →
Features researcher Marco Figueroa's direct accusation of 'fear mongering driven marketing,' a named expert skeptic absent from all other coverage reviewed.
Home and small business IoT devices might be the first target for such attacks because they're connected to the internet.
-
Al Jazeera Read →
Expert Roman Yampolskiy distinguishes AI worms from traditional malware as systems that reason about and adapt to unfamiliar devices mid-replication.
Shared on Bluesky by 16 AI experts (top 5 by trust)
-
Mark Riedl @markriedl.bsky.social
This is the most comprehensive description yet of how a model can “escape”. Out requires a few assumptions, like a worm that is exploiting vulnerable IOT hardware or unmonitored servers www.anthropic.com/research/sel... …
View on Bluesky →
Originally reported by anthropic.com
Read the original article →Original headline: Anthropic Red Team: Small Open-Weight Models Months From Self-Replicating Across Smart Ovens and Android TV Boxes