{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/anthropic-small-model-self-replication-iot-2026/",
 "asOf": "2026-10-30",
 "id": "anthropic-small-model-self-replication-iot-2026",
 "date": "2026-10-12",
 "datePrecision": "day",
 "title": "Anthropic reports a 9B model sets up inference on 8 of 9 hardware types and GLM-5.2 completes simplified replication",
 "lane": "capability",
 "kind": "eval-report",
 "summary": "Anthropic's Frontier Red Team reports simplified experiments on whether small open-weight models could replicate by running themselves on low-powered, poorly defended internet-connected devices. It says a 9B model got inference running on 8 of the 9 hardware types tested, and that GLM-5.2 reached all 8 nodes of an emulated fleet in 4 of 5 trials (7 of 8 in the fifth), with the exploit step deliberately kept trivial. The authors say small models could match that level by the end of 2026 if they improve at their historical rate, a rough extrapolation from a general capability index rather than a measurement.",
 "whyItMatters": "It is a lab's own evidence on one threat model for autonomous replication, separating inference setup, which it measured, from the exploit steps it simplified, and it gives a dated forecast that others can check.",
 "actors": [
  "anthropic"
 ],
 "topics": [
  "ai-malware",
  "capability-evaluation",
  "open-weight-diffusion",
  "ai-enabled-intrusion"
 ],
 "atlas": [
  "model",
  "eval-environment"
 ],
 "artifacts": [
  "glm",
  "llama",
  "claude-opus-4",
  "cyberseceval"
 ],
 "sources": [
  {
   "url": "https://www.anthropic.com/research/self-replicating-ai",
   "publisher": "Anthropic",
   "title": "AI models may be capable of self-replicating without access to a datacenter",
   "date": "2026-10-12",
   "type": "primary",
   "accessed": "2026-10-19"
  }
 ],
 "keyFacts": [
  {
   "fact": "Anthropic frames the work as one threat model, small weight-based replicators that compromise host devices and run inference on them. It splits replication into four stages (finding targets, gaining execution, establishing inference, continuing propagation) and says it largely sets aside the two exploit stages, citing earlier papers on small-model cyber capability, to measure inference setup. It names other routes it did not test, such as stolen API credentials or large replicators targeting datacenters.",
   "locator": "Introduction; Threat modelling"
  },
  {
   "fact": "The post states that a 9B model got inference running on 8 of the 9 hardware types tested. Section A names Qwen3.5-9B as setting up inference servers on hardware from Jetson Nanos to Mac PCs and RTX 4090s, and says GLM-5.2 is more reliable and serves faster. The task was serving Llama3.1-8B; the per-model, per-hardware table is interactive in the post, so the exact cell values are not recorded here.",
   "locator": "Opening summary; Section A, Evaluating inference setup performance"
  },
  {
   "fact": "In an emulated fleet of 8 cloud nodes running Android in a firewalled network, with an unauthenticated access step, GLM-5.2 was the one tested open-weight model that completed end-to-end replication: it reached 8 of 8 nodes in 4 of 5 trials and 7 of 8 in one. Anthropic says the other tested open-weight models failed reliably, that the worm's own model ran on a separate inference server because the nodes were too small, and that the trivial exploit step makes this an upper bound on real-world success. Each infection stood up Llama3.1-8B rather than GLM-5.2 itself; Anthropic treats this as a proxy for a small model of GLM-5.2's capability.",
   "locator": "Section B, Autonomous inference setup and replication"
  },
  {
   "fact": "Anthropic ran Gemma4-26B-A4B sharded across 15 off-brand Android TV boxes (about $55 each, 4GB RAM class), at 0.39 tokens per second in the opening demo and about 0.3 tokens per second, unoptimized, averaged over prefill and decode at a 32k context in section C. It estimates 71-150 hours for a full inference setup on that model and 28-51 hours for Qwen3.5-9B.",
   "locator": "Introduction; Section C; Appendix C"
  },
  {
   "fact": "Anthropic fits a trend line to open-weight models of 30B total parameters or fewer on the Epoch Capabilities Index (13.7 ECI per year, R2 of 0.95) and, taking GLM-5.2 as a capability floor, projects a small model at that level by the end of 2026. It calls ECI a proxy for replication ability and the date a rough estimate, and describes the claim of a future awash with agents on all hardware as a prediction beyond its experiments.",
   "locator": "Section B; Conclusion"
  },
  {
   "fact": "In an adaptation test, Qwen3.5-9B instances that inherited notes from predecessors raised inference-setup success from 45% in the first generation to between 61% and 84% in subsequent generations across six generations and 20 lineages. Giving the 9B model access to Opus 4.8 as an advisor produced no significant improvement, including after reinforcement learning on advisor use in a different task.",
   "locator": "Section D, Learning on the job; Taking advice"
  },
  {
   "fact": "Anthropic's rough spread estimate uses a past IoT botnet of over two million devices as a reference: about 133k replicas of the 26B model, roughly 80k tokens per second in total, at most about 40 H100s' worth of inference, and replication taking days. It says this is anchored on one device class and one past botnet. For edge accelerators it estimates 9,000 to 35,000 H100-equivalents exist and the reachable share is likely an order of magnitude or more lower.",
   "locator": "Section C; Appendix D"
  },
  {
   "fact": "On a locally replicated CyberSecEval 3 spear-phishing evaluation, scored by an LLM judge, small models rated 'very poor' to 'poor' once normalized to human raters. Anthropic says it expects social engineering to be done mostly by large models, and that it did not test whether AI botnets could act intelligently against defenders.",
   "locator": "Appendix E; Section E"
  },
  {
   "fact": "On defense, Anthropic suggests detection through network-flow anomalies and honeypots, and cites the Mirai remediation in which ISP quarantine and notification cleared 92% of infections within 14 days against 74% without notification. It adds that complete elimination would need coordination across every ISP with an infected network. The detection ideas are Anthropic's suggestions and the Mirai figures come from a past remediation; none was tested here.",
   "locator": "Section F, Blue-team mitigations"
  },
  {
   "fact": "All results are Anthropic's own, from simplified and contained setups, and the post reports no independent replication. The post does not describe a disclosure process, device vendor notification, or safeguards beyond the firewalled and contained test networks.",
   "locator": "Whole post; Section B"
  }
 ],
 "significance": 4,
 "fideQuestions": [
  "FID-075"
 ],
 "methods": [
  "cyber-ranges"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-19",
 "revisions": []
}