ANTHROPIC’S Frontier Red Team warns that small AI models could soon self-replicate across IoT devices, running inference directly on compromised equipment rather than from a data centre. In experiments, researchers used 15 off-brand Android TV boxes at about £45–£55 each, distributing a 26‑billion‑parameter open-weight model across them and achieving operation at roughly 0.39 tokens per second.
The study focused on whether AI inference could run on unfamiliar hardware and found that a 9‑billion‑parameter model worked on eight of nine hardware types tested. In a closed network of eight emulated Android devices, the full replication cycle was attempted with a deliberately trivial hacking step; of the open-weight models, only GLM‑5.2 completed replication to all eight devices in four of five runs.
Anthropic describes the GLM‑5.2 result as an upper bound for real‑world outcomes, noting that smaller models can already perform many individual steps but struggle when chaining those steps together. If improvements continue at historically observed rates, the company expects models at GLM‑5.2’s level by the end of 2026, with “small weight‑based replicators” potentially following shortly thereafter.
The potential threat is a wormable botnet that could spread across devices without a central command point, though defenders would retain advantages such as detecting unusual inter-device communications and securing devices by eliminating default credentials. The study also references the Kimwolf botnet scale, illustrating how a replication‑heavy threat could, in theory, involve tens of thousands of copies across millions of devices, albeit with substantial compute and time requirements.