Anthropic's frontier red team published a report on Monday, October 12, 2026, arguing that small artificial intelligence models are months, not years, away from being able to copy themselves onto the cheap internet-connected devices sitting in homes and small businesses — smart televisions, off-brand Android TV boxes, appliances — and keep running there without a data center behind them.
The practical point of the report is not that this is happening. It is that the hardware is already sufficient, and the models are close.
What the experiments actually did
The researchers, William Zhou and Daniel Freeman, tested nine kinds of hardware, from Jetson Nano boards to Mac desktops and RTX 4090 graphics cards. A 9-billion-parameter model, Qwen3.5-9B, managed to get itself running on eight of the nine.
In the demonstration that gives the report its image, the team split a larger model, Gemma4-26B-A4B, across 15 Android TV boxes costing about $55 each, with 4 gigabytes of memory apiece and two layers of the model per box. It worked, at 0.39 tokens per second — unusably slow for a person, but a machine with no deadline does not mind.
Replication from end to end is where current models still fail. Models of 30 billion parameters or fewer can complete many of the individual steps, the report says, but make mistakes when they have to chain them together. In simplified evaluations with some security steps removed, GLM-5.2 and stronger models finished the full process, and GLM-5.2 was the only open-weight model tested that did so reliably.
The timeline, and where it comes from
The end-of-2026 estimate is an extrapolation, and the report says so. The authors fit a trend of roughly 13.7 points a year on the Epoch Capabilities Index, with an R² of 0.95, and project when a small model reaches GLM-5.2's level. They describe the index as a rough proxy rather than a measurement of this specific task.
Two other findings are worth separating from the headline. Models improved across generations when each inherited notes from the one before: Qwen3.5-9B's success rate at setting up inference rose from 45 percent in the first generation to between 61 and 84 percent later. And giving the small model access to a frontier model for advice — Opus 4.8 — produced no significant improvement, because the small model could not work out what to ask.
Speed is the other constraint. Full inference setup took an estimated 71 to 150 hours for Gemma4-26B-A4B and 28 to 51 hours for Qwen3.5-9B. Scaled to a botnet the size of Kimwolf, which took in more than 2 million devices, the authors put the usable compute at roughly 40 H100-equivalents — small by data-center standards. Across edge devices generally they estimate 9,000 to 35,000 H100-equivalents, while noting that only a small share of that is reachable and vulnerable.
Why a network with no center is the problem
Anthropic's own framing is the line that has traveled: such a replicator would be "challenging to shut down, since there's no centralized point to shut off." A doubling time measured in days makes it slower than conventional malware, but conventional malware has a command server that can be seized.
Roman V. Yampolskiy, an AI and cybersecurity researcher at the University of Louisville, told Al Jazeera the findings were a significant development and that a worm of this kind could adapt and keep spreading without an operator — while adding that it is "not an existential threat" today. His caution was about combinations: self-replication plus hacking, persistence and strategic reasoning is a harder thing to switch off than any of those alone.
The defenses the report suggests are mundane, which is part of its argument. Watch for anomalous network traffic, such as large model transfers or devices running inference at each other. Quarantine infected devices and tell their owners — in the cleanup after the Mirai botnet, notifying owners cleared 92 percent of infections within 14 days, against 74 percent without notification. And ship devices with better defaults; the authors point to the United Kingdom's ban on default passwords in internet-connected products.
The report lands in a month of related claims. Anthropic's chief executive, Dario Amodei, said in September that AI might hijack "the entire internet" with "a persistent botnet" within a year or sooner. On the same day as the replication report, the company said its countermeasures had cut illicit data extraction by 90 to 99 percent, in what it calls distillation attacks.
Reporting from Al Jazeera, Reuters and Anthropic's published research.
