AI models may be capable of self-replicating without access to a datacenter
Anthropic’s red team describes controlled experiments in which smaller models completed parts of a replication chain on internet-connected devices.
TL;DR
- Anthropic reports a 9B model ran inference on eight of nine tested devices.
- Some models completed a replication task in a simplified evaluation.
- No real-world self-spreading model incident is reported.
Anthropic’s Frontier Red Team says its experiments found that a 9-billion-parameter model brought inference online on eight of nine tested hardware types. The company also reports that models at 30 billion parameters and below could perform many individual steps, while errors remained when combining them end to end. [1] [2]
The post says GLM-5.2 and stronger models completed an end-to-end replication task in a simplified evaluation. Anthropic presents this as a capability risk on commercial internet-of-things devices, not as evidence that a self-spreading model has been found operating in the wild. [1] [2]
Anthropic estimates that models with this capability floor could become small enough to run on consumer devices by the end of 2026 if historical improvement continues. That timing is a projection based on a trend line, and the company’s post describes its own experimental setup rather than an independently replicated result. [1] [2]
The security question is whether model-enabled automation changes the scale or adaptability of malware, and what safeguards device makers and cloud-management providers can deploy. Anthropic says outbound management tunnels may create reachability paths; real-world prevalence, reliable autonomous spread, and practical containment remain unconfirmed. [1] [2]
Why it matters
The report makes a conditional capability and security claim based on controlled evaluations; it does not report an active outbreak.
Editor's note
Experiment and forward projection are distinguished; no real-world self-replicating incident is asserted.