Can Small AI Models Self-Replicate on IoT Devices?

The Anthropic Frontier Red Team has published research, dated October 12, 2026, arguing that "small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices," according to the Anthropic post by William Zhou and Daniel Freeman. The work asks a narrow question: can a model of modest size copy itself, and the software needed to run it, onto cheap devices without a datacenter? The authors describe "signs of life" rather than a finished threat, and the details matter for reading the headline correctly.

What the Frontier Red Team tested

Anthropic's team evaluated open-weight models of 30 billion parameters or fewer on a sequence of replication steps: find a device, gain access, install an inference server, transfer model weights and start the next copy. Its summary is that these models "can complete many individual replication steps" but make mistakes when chaining them end to end.

Three experiments carry most of the findings:

• Hardware coverage. Qwen3.5-9B set up inference on 8 of 9 hardware types tested. The range included Jetson Nano boards, Mac PCs and RTX 4090 machines.
• Headline demo. Gemma4-26B-A4B ran across 15 off-brand Android TV boxes with 4 GB of RAM each, at about 0.39 tokens per second. At roughly $55 per box, the cluster cost about $825 in hardware (15 x $55), by simple arithmetic on the reported figures.
• End-to-end replication. On an eight-node network of cloud-hosted Android 15 emulators, GLM-5.2 spread to all 8 nodes in 4 of 5 trials and to 7 of 8 in the fifth. Other open-weight models failed reliably.

Why the results are not a finished threat

The post is explicit about limits, and they shape how much weight the numbers can bear.

• A deliberately easy entry point. The exploit step was kept trivial, using unauthenticated Android Debug Bridge access. The authors say this makes the results an upper bound on real-world success.
• A small, controlled network. Eight nodes is a test bed, not the open internet. The spread estimates rest on one hardware class and one past botnet.
• Slow by design. Full setup took 28 to 51 hours per Qwen3.5-9B replica and 71 to 150 hours for Gemma4-26B, roughly 1 to 2 days for a 9B model.

• Weak at social engineering. The authors rate small models' spear-phishing ability as "very poor" to "poor" when normalised to human raters.
• Outside help did not help much. Giving the 9B model access to a frontier advisor (Opus 4.8) produced no significant improvement, which the authors attribute to small models being weaker at using advice.

The trend and the scale estimate

Two further results point forward rather than describing the present. Across six generations of Qwen3.5-9B, each inheriting notes from its predecessor, setup success rose from 45% to between 61% and 84% in later generations. Separately, a least-squares fit on a general capability index (ECI, 13.7 points per year, R-squared 0.95) leads the authors to estimate that a small model could reach GLM-5.2's level by the end of 2026. They note the index is a rough proxy, so the timeline is approximate. A scripted-setup ablation on 17 nodes found even a 3B model reached about half of them, which the authors say bounds what the evaluation fails to measure.

On scale, the post estimates that a botnet like Kimwolf, with over 2 million devices, could support roughly 133,000 model replicas, or about 80,000 tokens per second, comparable to about 40 H100 GPUs. Dividing the two figures gives about 0.6 tokens per second per replica, which is consistent with the sub-1 token per second speeds in the demo. Replicas that slow would be poor at real-time work. The authors also expect that coordination would come from large models directing small subagents, since small models use advice poorly.

Detection and mitigation

The authors argue replication would leave visible traces: multi-gigabyte payload transfers, device-to-device inference traffic and scanning, all detectable in ISP flow monitoring, plus honeypots that can capture the payload. For quarantine they cite Mirai, where ISP quarantine with user notification cleared 92% of infections within 14 days, against 74% with no notification, an 18 point difference. They also point to manufacturer defaults and regulation, such as the UK ban on default IoT passwords, as ways to shrink the target pool.

The same post cautions that slow, distributed replicators are hard to shut down because there is no central point to disable, and that unlike pre-AI malware these agents could work out unfamiliar devices on their own.

How to read this

The findings are best treated as a measured early warning from a single lab's evaluation, not a field observation. The reported success rates come from a controlled, easy-entry setup, and the timeline depends on a rough capability proxy. For teams choosing models, the practical takeaway is that open-weight capability trends deserve the same monitoring as closed models, and tooling that stays model-agnostic, as on Metir, makes it easier to re-evaluate as those trends move.

Sources:

• AI models may be capable of self-replicating without access to a datacenter - Anthropic Frontier Red Team

Image credits

Header image: Raspberry Pi 4 Model B, top view, by Laserlicht, Wikimedia Commons, CC BY-SA 4.0 (source); a file photo of a representative single-board computer, not hardware used in the study. In-body image: NVIDIA Jetson Nano Developer Kit by SparkFun Electronics, Wikimedia Commons, CC BY 2.0 (source).