Anthropic: Small Open Models Months From IoT Self-Replication

"Small AI models may be months away from being capable enough to self-replicate on commercial IoT devices." That is the opening claim of a Frontier Red Team report published Monday by Anthropic researchers William Zhou and Daniel Freeman.

Only one open-weight model they tested cleared the full bar. "Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication," the paper states, with GLM-5.2 reaching all eight target nodes in four of five trials. Smaller models fell short of that but got close on the individual steps. Qwen3.5-9B set up inference on 8 of 9 hardware types the team threw at it, and its success rate climbed from 45% to between 61% and 84% as the agent inherited notes across generations.

The concrete detail: the team bought fifteen off-brand Android TV boxes at roughly $55 each, networked them together, and ran Gemma4-26B-A4B across the cluster at 0.39 tokens per second. As a reference for scale, the authors point at Kimwolf, the IoT botnet whose peak infection count sat "somewhere over 2 million" devices, primarily off-brand Android TVs. At that size, they estimate the pool could host around 133,000 concurrent copies of Gemma4-26B-A4B.

The methodology carries its own hedges. The cyber evaluation uses "trivial" elements such as unauthenticated ADB ports, the Edge Compute Index is "only a proxy metric for replication ability," and spear-phishing capability in the small models rated "very poor to poor." The projection is a trend extrapolation, not a demonstrated capability in a 9B-class model today.

Zhou and Freeman close on this: "We expect a future awash with agents running on all types of hardware, including some that aren't under human control."