A cluster made of television boxes
Anthropic’s Frontier Red Team has published an evaluation arguing that small open-weight language models may be “months away from being capable enough to self-replicate” on cheap consumer hardware, with no data centre involved. The post, AI models may be capable of self-replicating without access to a datacenter, is credited to William Zhou and Daniel Freeman and went up on 12 October.
The demonstration is deliberately unglamorous. The team split Gemma4-26B-A4B across fifteen off-brand Android TV boxes costing roughly $55 each, with 4GB of RAM apiece, and got about 0.39 tokens per second out of the cluster. At 4-bit quantisation, it estimates a 9B model needs four or more such boxes and a 26B model ten or more.
Eight of nine hardware types
The first experiment asked whether a model could get itself running on hardware it had never seen. Qwen3.5-9B set up inference servers on eight of the nine hardware types the team tried, from Jetson Nanos to Mac desktops and RTX 4090s. The agent harness, called Memento and built on the open-source Pi coding agent, restarts the agent with notes from earlier attempts rather than letting it fixate. Across six generations inheriting those notes, the setup success rate rose from 45% to between 61% and 84%.
Handing the small model a frontier advisor made no difference. Access to Claude Opus 4.8 produced no significant improvement, and neither did a version trained with reinforcement learning to use the advisor. Anthropic’s explanation is blunt: “small models tend to not know the right questions to ask.”
One model already does it end to end
The second experiment ran a firewalled network of eight Google Cloud nodes, each running an Android emulator with an unauthenticated debug port. Of the open-weight models tested, only GLM-5.2 managed full end-to-end replication, reaching all eight nodes in four of five trials and seven of eight in the fifth. Models at 30B parameters or below could complete individual steps but made mistakes chaining them together.
The forecast rests on a trend line. Among models of 30B parameters or fewer, the Epoch Capabilities Index has been rising about 13.7 points a year, with an R² of 0.95. Extended, that puts a small model at GLM-5.2’s level by the end of 2026. The team calls the estimate rough, since the index is a proxy.
Why it would be hard to switch off
A replicator of this kind would be slow — the team puts the doubling time at days — but it would have “no centralized point to shut off”. The scale comparison is with the Kimwolf botnet, which peaked at more than two million infected devices. If every fifteen-box group ran the 26B model, that would be roughly 133,000 replicas serving about 80,000 tokens per second in total: the equivalent of around 40 H100s, which the authors describe as a tiny amount of compute in absolute terms.
The difference from an ordinary botnet is portability. Traditional worms target a specific device type; a model that can set up its own inference is not tied to one.
What defenders have, and what the team concedes
On the blue-team side, the post points to network-flow monitoring, which would show large model payloads moving and sustained device-to-device traffic, and to quarantining infected subscribers at the ISP — a tactic that cleared 92% of Mirai infections within fourteen days, against 74% with no notification. It also notes that UK rules making default IoT passwords non-compliant shrink the pool of targets.
The caveat is the team’s own. Its evaluation “keeps the cyber-exploit element of the replication trivial”, which makes the headline result an upper bound on real-world success. “We don’t yet have a full rogue replicator,” the authors write. Nobody has found one in the wild either. What the post claims is narrower and still awkward: each individual step now works.
