Anthropic tests AI replication: stronger model completes simplified cycle, small models fall short
In a contained experiment, Anthropic found that GLM-5.2 could complete a simplified replication cycle, while small models suited to low-powered devices failed. It did not demonstrate a complete rogue AI worm; a possible year-end timeline comes from extrapolating capability trends.
Anthropic’s Frontier Red Team studied whether AI could replicate outside a datacenter: whether inexpensive devices can supply compute, whether models can establish inference on unfamiliar hardware, and whether those steps can be completed together. Some components are already feasible, but the small models suited to this hardware did not complete the tested full cycle. The authors explicitly say they do not yet have a complete rogue replicator.
For the compute demonstration, researchers bought and manually networked 15 inexpensive Android TV boxes. Together they ran Gemma4-26B-A4B at 0.39 tokens per second. This showed that weak devices can collectively serve a model; it did not demonstrate autonomous infection of those boxes. In a separate inference-setup test, Qwen3.5-9B succeeded on eight of nine hardware categories. Most were cloud instances, with only two physical bench-device categories, and the Jetson column used a different target model from the other columns.
The full-cycle test used eight cloud nodes emulating Android inside a firewalled environment, with access deliberately simplified. Tested agents set up Llama3.1-8B on target nodes while their own controlling models ran on separate inference servers. After correctness checks, the evaluator launched another agent on the new node. This is a proxy for the ability to perform the steps, rather than GLM-5.2 moving and running itself on low-powered IoT hardware.
In this simplified test, GLM-5.2 reached all eight serving nodes in four of five trials and seven in the remaining trial. The other tested models failed to complete the full cycle. A separate 17-node experiment supplied inference setup through a script, making it easier; it does not replace the full-cycle result. The authors also say that the deliberately trivial compromise step makes their evaluation an upper bound on real-world success.
The gap is between models small enough for weak devices and models capable enough to combine the steps reliably. The successful stronger model still relied on external compute. Extrapolating a historical trend in a general capability index, Anthropic estimates that small models could reach a similar capability level by the end of 2026. That index is only an indirect proxy for replication ability, so the timing is a projection, not an observed result. The inference-setup figure labels its data as of July 30; the article’s new publication date is not the date of every experiment.
The study gives defenders a concrete reason to consider distributed compute on inexpensive connected devices alongside large datacenters. The authors recommend watching for unusually large model transfers and sustained device-to-device traffic, isolating infected devices, notifying owners and improving security defaults. The report does not establish an in-the-wild AI worm outbreak or vulnerabilities in the chips and products used for testing.
Sources
- AI models may be capable of self-replicating without access to a datacenter — Anthropic
- Each model sets up Llama3.1-8B by itself — how fast does it run? — Anthropic