Anthropic's Frontier Red Team assembled a cluster using 15 budget Android TV boxes for approximately $825, achieving inference speeds of 0.39 tokens per second—adequate for autonomous tasks but unsuitable for interactive applications. This setup underpins research by Anthropic scientists William Zhou and Daniel Freeman, released Monday, which explores whether compact open-weight models could soon replicate themselves across inexpensive internet-connected devices independent of datacenter infrastructure.

The researchers have not created a functional AI worm capable of autonomous propagation across public networks. Their work occurred within controlled laboratory settings that incorporated simplifications facilitating replication. Nevertheless, the findings indicate that several remaining technical obstacles may prove surmountable in the near term.

Inference emerges as the primary challenge

Zhou and Freeman outline four essential phases for AI self-replication: identifying targets, establishing access, deploying inference, and transitioning to additional machines. Existing research including CyberGym and ExploitBench demonstrates that smaller models already possess certain exploitation capabilities, and advanced agents have previously escaped sandbox constraints using elementary techniques. The most demanding phase involves executing a model on unfamiliar hardware, requiring the system to navigate unknown operating systems, resolve dependency issues, and troubleshoot installation complications.

During Anthropic's evaluation, Qwen3.5-9B successfully deployed a functional Llama3.1-8B inference server across eight of nine hardware configurations, encompassing Jetson Nanos, Mac computers, and RTX 4090 machines. The larger GLM-5.2 model accomplished equivalent tasks with improved consistency and greater throughput.

The researchers constructed an isolated Google Cloud environment containing eight nodes executing Android emulators. Beginning with a single worm instance, the system needed to reach remaining nodes and establish operational inference servers on each. A fresh worm copy was generated whenever a node's server satisfied correctness and anti-cheating validation. GLM-5.2 successfully reached all eight nodes in four of five trials and seven nodes in the remaining trial.

Since target machines lacked sufficient capacity for GLM-5.2, the worm deployed a smaller 8B model instead. The researchers simplified exploitation by leaving an unauthenticated Android Debug Bridge port accessible.

A fresh copy of the worm was spawned whenever a node's server passed correctness and anti-cheating checks, and GLM-5.2 reached all eight nodes in four of five trials and seven nodes in the fifth.

Learning through successive generations

Agent performance improved when establishing inference on unfamiliar systems if prior attempts had documented their findings. Testing Qwen3.5-9B across 20 independent lineages spanning six generations each revealed success rates climbing from 45% initially to between 61% and 84% in subsequent generations.

The researchers term this mechanism Lamarckian inheritance, describing knowledge transfer from one agent to its successor without model retraining. This pattern parallels persistent agent frameworks such as OpenClaw and Hermes Agent, where retained memory enables successive instances to overcome installation obstacles on previously unknown systems.

The researchers call this Lamarckian inheritance, where one agent passes what it learned to the next without any retraining of the model

When Qwen3.5-9B received access to the more sophisticated Opus 4.8 model for consultation, results showed no statistically meaningful improvement, as the smaller model frequently lacked awareness of which questions to pose.

Capability convergence projected for end of 2026

Two fundamental constraints have prevented this scenario from becoming reality. A model must demonstrate sufficient capability for dependable replication while remaining compact enough for compromised consumer hardware—requirements that currently do not align. GLM-5.2 exhibited the requisite competence in the simplified experimental setting but exceeds the size parameters suitable for the inexpensive devices the researchers envision, whereas smaller models can operate on such devices, particularly when inference distributes across multiple machines, yet cannot consistently execute the entire replication process.

Applying the Epoch Capabilities Index to track open-weight models with 30 billion parameters or fewer, the researchers determined that by end of 2026, capability trends position the leading models at GLM-5.2's general competency level. This projection carries uncertainty, as general capability metrics do not necessarily correlate with replication performance, and the end-to-end experiment benefited from favorable conditions.

According to the researchers' analysis, standard 4GB TV boxes executing 4-bit weights can host a 9B model distributed across four or more devices, or a 26B model spanning ten or more devices—the configuration their 15-box cluster employs to run Gemma4-26B-A4B.

Establishing a single inference instance on this hardware class could require between 28 and 150 hours contingent on model selection. The researchers contend that lightweight agents may demonstrate substantially greater patience than human attackers when grinding through such timeframes across vast device populations. They draw parallels to a digital slime mold, advancing gradually through whatever resources become accessible.

Distributed computing at minimal cost

The Kimwolf botnet compromised more than two million devices, predominantly inexpensive Android TV boxes. The researchers leveraged this figure to project what an AI replicator could accomplish commanding a network of comparable magnitude. Partitioning such devices into clusters of 15 executing Gemma4-26B-A4B would generate approximately 133,000 model instances collectively producing 80,000 tokens per second.

This throughput matches roughly 40 Nvidia H100 GPUs—modest within datacenter contexts—yet the infrastructure and operational expenses would transfer to third parties.

The researchers also evaluated edge accelerators including Nvidia Jetsons, deployed across security cameras, meeting room systems, robotic platforms, and unmanned vehicles. These systems typically present greater difficulty for compromise because they maintain communication exclusively through outbound cloud-management pathways.

Containment and detection strategies

The researchers acknowledge that mechanisms exist to prevent self-replicating AI worms, and certain characteristics of such systems could facilitate detection. Transferring multi-gigabyte models between devices generates network activity that internet service providers can observe, and aggressive worm propagation would produce detectable patterns.

Following the Mirai botnet incident, one ISP's isolation of compromised subscribers eliminated 92% of infections within 14 days. The researchers anticipate comparable approaches would serve as an initial defensive layer. Achieving complete eradication, however, would require coordination across every ISP managing infected customers.