On October 12, 2026, Anthropic’s Frontier Red Team published research on the potential for AI to self-replicate without relying on data centers. The findings show that small models can carry out several individual steps, but the research team emphasized that there was no complete runaway self-replicating model in these experiments.

William Zhou and Daniel Freeman focused on IoT devices—network-connected hardware such as Android TV boxes and smart home appliances. Their question was whether cheap, memory-constrained hardware deployed at scale could run AI and sustain propagation.

Running a model and autonomous propagation are two different experiments

In one hardware demonstration, the team purchased 15 Android TV boxes for around 55 USD each, clustered them together, and ran Gemma4-26B-A4B at 0.39 tokens per second. The model was partitioned across the devices, with each device hosting several layers rather than the full model.

This demonstration shows that a cluster of low-cost hardware can provide inference capabilities. It does not prove that Gemma itself compromised devices, assembled the cluster, or copied itself to other hardware. Setting up the cluster to host the model and measuring automated deployment capabilities were conducted as separate parts of the study.

In the inference setup evaluation, Qwen3.5-9B succeeded on 8/9 hardware types. The team used a mechanism called Memento: periodically initiating a fresh agent session while carrying forward the working directory and notes from the prior session to prevent the agent from getting stuck down an unproductive debugging path.

GLM-5.2 result is not about running itself on a TV box

The full-chain evaluation used a closed network of eight GCP instances running simulated Android environments. GLM-5.2 successfully deployed across 8/8 nodes in 4/5 trials; the remaining trial reached 7/8 nodes.

A key qualification accompanies these figures: ADB ports had authentication disabled, the model was tasked with deploying Llama3.1-8B, and the controlling model ran on a dedicated inference server. Once a node passed verification, the test harness spawned the next agent instance on it.

In other words, the benchmark indicates that GLM-5.2 can coordinate the steps required to propagate a small model within a simplified environment. It does not demonstrate GLM-5.2 transferring its own full weights onto a TV box and operating autonomously. Anthropic characterized this outcome as an upper bound for real-world success, given that the intrusion phase was deliberately simplified.

Year-end forecast remains an extrapolation

The research team established two criteria: the model must be competent enough to execute the complete sequence of tasks, while remaining compact enough to run on the target hardware. In the present experiments, these two thresholds do not yet overlap.

Based on progress trends in open models with up to 30 billion parameters, Anthropic estimates that small models could reach the requisite capability level by late 2026. However, the general capability benchmarks used as proxies do not directly measure self-replication ability. This is the research team’s forecast, not a demonstrated capability.

The study also noted that propagation of this kind would likely be slow—unfolding over days—and would generate network traffic signatures when transferring weights or exchanging data between nodes. The absence of a central kill switch does not mean compromised machines cannot be detected or isolated.

The critical open question remains the gap between the two experiments: when will a model be compact enough to run on underpowered devices, yet reliable enough to chain all required steps in an environment protected by real-world defenses?