{"slug": "could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it", "title": "Could AI Copy Itself Onto a Smart Oven? Anthropic Tested It", "summary": "Anthropic published research on October 12, 2026 finding that open-weight AI models of 30 billion parameters and under can already perform many individual self-replication steps but fail when chaining them together, while GLM-5.2 completed the full cycle in a simplified test. In the experiment, researchers William Zhou and Daniel Freeman networked fifteen $55 off-brand Android TV boxes running Gemma4-26B-A4B at 0.39 tokens per second, and Qwen3.5-9B set up inference on 8 of 9 hardware types; Anthropic estimates small models could reach full self-replication capability by the end of this year if historical improvement rates hold. Anthropic said the test used an unauthenticated Android debug port, making the results an upper bound, and recommended existing defences including no default passwords, patched firmware, segmented networks and ISP quarantine, citing a Mirai cleanup where quarantine and notification cleared 92% of infections in 14 days versus 74% without.", "body_md": "On October 12, 2026, Anthropic published [a research post by William Zhou and Daniel Freeman](https://www.anthropic.com/research/self-replicating-ai) with a title that reads like a warning: AI models may be capable of self-replicating without access to a datacenter. The experiment behind it is concrete. The researchers bought fifteen off-brand Android TV boxes at about $55 each, networked them together, and ran a 26-billion-parameter open-weight model across them. Then they asked whether small models could do the harder thing: find a device, break in, get themselves running and repeat, with no human steering.\n\nTheir answer, in their own summary, is that small models may be months away from being capable enough to copy themselves onto commercial internet-of-things devices such as smart ovens and off-brand TV boxes. Models of 30 billion parameters and under can already do many of the individual steps but make mistakes when chaining them. One larger open-weight model, GLM-5.2, completed the whole cycle in a simplified test. If small models keep improving at their historical rate, Anthropic expects them to reach that level by the end of this year.\n\nThis post explains the experiment for a business reader. The second half covers what a company that owns a lot of cheap connected devices should take from it, which turns out to be the same advice security teams have given for a decade, now with a new reason to follow it.\n\n1. 01Small models can do the steps but not yet the chain.Anthropic found models of 30B parameters and under complete many individual replication steps but make mistakes composing them end to end. In its simplified test, only GLM-5.2 and stronger models finished the full cycle.\n2. 02A 9B model set up inference on 8 of 9 hardware types.The least studied and possibly hardest step is getting a model running on unfamiliar hardware. Qwen3.5-9B managed it on devices from a Jetson Nano to a Mac to an RTX 4090 in Anthropic's test.\n3. 03Cheap TV boxes can run a real model, slowly.Anthropic ran Gemma4-26B-A4B across fifteen $55 Android TV boxes at 0.39 tokens per second. Anthropic separately estimates a single 9B-model replication at over one to two days (28 to 51 hours of inference setup).\n4. 04The test deliberately skipped the break-in.Anthropic's network used an unauthenticated Android debug port, so the results are an upper bound on real-world success. It notes that past IoT botnets such as Mirai spread using default manufacturer passwords, so the gap may be smaller than it sounds.\n5. 05The defences are the ones you already know.No default passwords, patched firmware, segmented networks and an ISP that can quarantine infected customers. Anthropic cites a Mirai cleanup where ISP quarantine and notification cleared 92% of infections in 14 days against 74% without.\n\n## 01 — The QuestionWhat Anthropic actually *asked*.\n\nThe research sits inside a concern AI safety people have had for years, under the name autonomous replication and adaptation. The idea is a model that deploys and spreads itself without anyone controlling it. In computer security the nearest cousin is a worm, a program that copies itself from one machine to the next without a human clicking anything. Anthropic's framing is that an AI worm could carry its model weights with it as part of the payload, or re-download them from a public hub, and then run on whatever hardware it lands on.\n\nEarlier work, which the post cites, had already shown that AI agents can behave like a worm across a cluster of datacenter GPUs. Those are valuable targets and relatively well defended. The new question was whether expensive hardware is needed at all. Homes and small businesses are full of cheap devices with a few gigabytes of memory and a network connection, and historically very little security. Could enough of them, working together, run a model capable of spreading itself?\n\nAnthropic lays out three ways an AI replicator might work. The first, and the one it tested, is a small model that spreads by compromising the devices it runs on, which the post calls a weight-based replicator. The second is a large model that goes after datacenters, either from inside a lab's own infrastructure or as an open-weight model starting without a lab's compute. The third is a model that replicates by stealing credentials for a hosted AI service and running on someone else's account. The post picked the first because it is a near-term threat model it could test directly.\n\n## 02 — The DemoA model on fifteen *TV boxes*.\n\nThe most concrete part of the post is a demonstration. Anthropic bought fifteen off-brand Android TV boxes, the kind that sell for around $55 and run forks of the Android Open Source Project with few security features added by the manufacturer. Each box had 4 gigabytes of memory. The researchers split Gemma4-26B-A4B, a 26-billion-parameter open-weight model from the same family as the [Gemma 4 model that runs on a laptop](https://www.digitalapplied.com/blog/gemma-4-12b-multimodal-local-ai-laptop-private-agents-guide), into slices and gave each box two of the model's layers. Running together, the fifteen boxes produced 0.39 tokens per second.\n\nThat is very slow. A single datacenter GPU serves the same model at around 1,950 tokens per second at high concurrency with speculative decoding, a figure the post takes from a third-party benchmark. But the point was never speed. It was that a model of this size runs at all on hardware this cheap. Anthropic's arithmetic: with 4 gigabytes per box and the model compressed to 4-bit weights, a 9B model fits on four or more boxes and a 26B model on ten or more.\n\nThe choice of device was not random. The post names Kimwolf, an IoT botnet that infected over two million devices, mostly off-brand Android TVs, as the representative threat. Those botnets exist today and run hard-coded malware. The question the demo raises is what happens when the payload is a model instead of a script.\n\n## 03 — StagesThe four stages of *copying yourself*.\n\nAnthropic breaks replication into four steps: finding targets on a network, gaining execution on one, setting up inference so the model can run there, and propagating onward from the new host. The first two are the classic break-in, and the post largely sets them aside because other papers have already measured small models on cyber exploits. The third step is the one it says is least studied and probably hardest for a small model.\n\nSetting up inference means a long chain of hardware-specific decisions: choosing an inference stack that works on this chip, finding package versions that fit this operating system, and debugging whatever goes wrong, with each step depending on the one before. The failure case the post describes is instructive. A Qwen agent spent hours debugging package versions when the real bug was that it had implemented an endpoint the grader could not talk to. Small models get stuck on a wrong idea and keep digging.\n\nTo work around that, Anthropic built a harness it calls Memento on top of an open-source coding agent. Every so often it starts a fresh copy of the agent with the previous copy's workspace and a short set of notes on what was tried. The post is careful to say Memento improves long-horizon reliability rather than adding any new cyber or inference skill, and that it expects small models to get better at this even without such a harness.\n\n##### Find targets, gain execution\n\nAnthropic's test network left an Android debug port open with no authentication, so these stages were trivial. It cites earlier work showing small models can run exploits when given tools.\n\n##### Set up inference on the new host\n\nPick a stack, find working package versions, debug the machine. A 9B model managed this on 8 of 9 hardware types; the post calls it the least studied and possibly the most challenging step for small models.\n\n##### Propagate onward\n\nWith setup scripted away, even a 3B model reached about half the nodes of a 17-node network. The command-line grunt work is not the bottleneck.\n\n## 04 — ResultsWhat worked, and what *failed*.\n\nThere are two experiments to keep apart. The first measured the inference-setup step alone: could a model get an 8-billion-parameter Llama model serving on a range of unfamiliar hardware? Small models such as Qwen3.5-9B could, on machines from a Jetson Nano to a Mac to an RTX 4090 graphics card. More capable models like GLM-5.2 did it more reliably and ended up with faster serving speeds, which would mean faster spread.\n\nThe second experiment chained everything together on a private cloud network of eight nodes running an Android 15 emulator, each with an unauthenticated debug port. A \"patient zero\" node was seeded with the worm. Each hop meant scanning for a target, getting a shell on it, sending over the weights and harness, and standing up an inference server that passed Anthropic's correctness and anti-cheating checks. Only then did a new copy of the worm spawn on the target.\n\n| All figures from Anthropic's research post of October 12, 2026, on networks Anthropic built. Anthropic describes the replication test as an upper bound on real-world success. |  |  |  | \n|---|---|---|---|\n| Test | Model | Result | Condition | \n|---|---|---|---|\n| Inference setup on unfamiliar hardware | Qwen3.5-9B | 8 of 9 hardware types | Memento harness, 6-hour limit | \n| Full replication, 8-node network | GLM-5.2 | 8/8 in 4 of 5 trials, 7/8 in 1 | Unauthenticated debug port | \n| Full replication, 8-node network | Other open-weight models tested | Fail reliably | Same network | \n| Propagation only, 17-node network | A 3B model | About half the nodes | Inference setup pre-scripted | \n| Six generations inheriting notes | Qwen3.5-9B | 45% → 61–84% setup success | 20 lineages, Memento | \n\nThe headline result is that GLM-5.2, the open-weight model we have written about as an [executor in a two-model stack](https://www.digitalapplied.com/blog/fable-5-glm-5-2-dual-model-stack-orchestrator-executor), was the only model in the set that completed end-to-end replication, and it did so reliably, reaching all eight nodes in four of five runs. Every other model tested failed reliably. Anthropic draws a floor and a ceiling from this. The floor is the capability a model needs to replicate dependably, which GLM-5.2 clears. The ceiling is the size a model can be and still fit on the devices it is attacking, which Qwen3.5-9B and the 26B Gemma model fit for 4-gigabyte TV boxes. Today the floor is above the ceiling: the models that can do it are too big for the hardware.\n\nThen comes the forecast. Anthropic plotted open-weight models of 30 billion parameters or fewer against a general capability index by release date and fitted a line to the best model at each point. The line gains 13.7 points a year. Extending it puts a small model at GLM-5.2's level by the end of 2026. The post adds its own caveat: the index measures general capability, not replication, so the date is a rough estimate.\n\nLike coding agents in 2024, we're seeing signs of life for AI worms. We don't yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain.William Zhou and Daniel Freeman, Anthropic, October 12, 2026\n\n## 05 — SpeedHow fast it could *spread*.\n\nA model running on TV boxes is nothing like a chatbot. Anthropic measured about 0.3 tokens per second for its 26B model across a 32,000-token working window, averaged over reading and writing. At that rate, filling one window takes 27 to 32 hours, and a complete inference setup needs between roughly 2.6 and 4.7 windows. The post's table puts a full setup at 71 to 150 hours for the 26B model and 28 to 51 hours for the 9B one.\n\nThe scale estimate is the part most likely to be quoted out of context, so here it is with its assumptions. Take a fleet the size of Kimwolf's two million devices. If every fifteen TVs ran one copy of the 26B model, that is about 133,000 copies. Each group can serve two agents at roughly 0.3 tokens per second, giving around 80,000 tokens per second across the whole botnet. Anthropic's comparison: that is at most about forty H100 GPUs' worth of inference, which it calls a tiny amount of compute in absolute terms.\n\nIts own analogy is a slime mould or a swarm of fruit flies, things that multiply over days rather than seconds. The researchers also note that a real replicator would not be limited to one device class, would not need to load a model onto every device it compromised, and would get faster as edge hardware improves and the minimum model size falls. The slow version is the near-term one, not the only one.\n\n## 06 — AdaptationLearning on the *job*.\n\nThe \"adaptation\" half of the threat is what would separate an AI replicator from ordinary malware. A script does the same thing on every machine. A model can leave notes for its successor. Anthropic tested this by running Qwen3.5-9B through six generations, each inheriting the previous one's brief notes on strategies tried and failures hit, then attempting the same setup again. Success rose from 45% in the first generation to between 61% and 84% in later ones, across twenty separate lineages.\n\nOne result cuts the other way. The researchers gave the small model access to a far stronger one, Claude Opus 4.8, as an adviser it could call or that would offer unprompted advice when it got stuck. It did not measurably help. Small models, the post says, tend not to know the right questions to ask, and do not improve when advice arrives unasked. Even training the small model to use an adviser on coding problems did not transfer well. Anthropic's reading is that if coordination happens, it will be a large model doing the strategy and spinning up small ones as workers, not small models phoning a friend.\n\nA second limit appears in an appendix on spear-phishing, the craft of writing a targeted message that tricks someone into handing over a password. On a standard evaluation, small models scored very poor to poor once adjusted to human raters. Their coding and hacking ability has raced ahead of their writing and persuasion. For now, a small replicator would get in through a weak port, not a convincing email.\n\n## 07 — LimitsWhat this research is *not*.\n\nIt is easy to read \"AI can copy itself onto your oven\" and skip the conditions. Three of them matter. First, nothing here was observed in the wild. Every number is from a network Anthropic built, with a model Anthropic chose as the payload. Second, the break-in was deliberately trivial. The test nodes had an Android debug port open with no authentication, and the post says plainly that this makes the result an upper bound. Third, the full cycle was completed only by GLM-5.2, which is too large to run on the devices it was propagating across; it ran on a separate server while standing up a smaller model on each node.\n\nAgainst those caveats sit two counter-points, the first from the post itself. Real IoT botnets have spread through nothing more sophisticated than a list of default manufacturer usernames and passwords, as Mirai did, so \"trivial\" may not be far from reality for the worst devices. And the capability trend that would put a small model over the floor is a fitted line through released models with a stated goodness of fit, not a guess. The research is a forecast with stated assumptions, and it should be read as one. Our [look at Anthropic's earlier open-weight cyber findings](https://www.digitalapplied.com/blog/glm-5-3-cyber-exploits-anthropic-open-weight-risk) covers the same lab's reasoning about why small open models are the class to watch.\n\n## 08 — DefencesWhat still *works* against it.\n\nAnthropic frames defence like an epidemic: push the number of new devices each infected device goes on to infect below one, and the replicator dies out. Several things favour the defender. A model payload is multiple gigabytes, and shards talking to each other produce sustained traffic between devices that would never normally communicate, so a spreading replicator leaves a signature an internet provider's flow monitoring can see. The faster it spreads, the louder it is. Once found, decoy devices can capture a copy for analysis.\n\nThe strongest evidence it cites is historical. When Mirai was being cleaned up, one internet provider used external infection evidence to quarantine affected customers, restricting them to a short list of sites and redirecting their browsers to cleanup instructions. That cleared 92% of infections within 14 days, against 74% with no notification. Anthropic expects quarantining to work about as well as a first response to a weight-based replicator, while noting that full elimination would need every affected provider to coordinate.\n\nThe third lever is the device itself. The post points to the UK, where default passwords on consumer smart devices are now non-compliant. The law behind that, the Product Security and Telecommunications Infrastructure Act, has applied to manufacturers since April 29, 2024. In the words of the UK National Cyber Security Centre's [explainer](https://www.ncsc.gov.uk/blog-post/smart-devices-law), \"the manufacturer must not supply devices that use default passwords,\" must provide a contact point for reporting security issues, and must state how long the device will receive security updates. None of that was written with AI replicators in mind. All of it raises the floor the replicator has to clear.\n\nFor a business, the translation is a short list, and it is the same list a security consultant would have given before this research existed; the wider breach picture is in our [cybersecurity statistics round-up](https://www.digitalapplied.com/blog/cybersecurity-statistics-2026-data-points). Change every default credential on every connected device, including the ones that came from the TV installer. Keep firmware updated and retire devices whose makers no longer ship updates. Put cameras, screens, kitchen equipment and conferencing kit on their own network segment so a compromised fridge cannot see the finance team's laptops. And watch for devices talking to each other at volumes that make no sense for what they do. Our [AI transformation practice](https://www.digitalapplied.com/services/ai-transformation) includes this kind of device inventory when a company starts putting agents and AI hardware on its network.\n\n##### No defaults, anywhere\n\nEvery camera, screen, TV box, printer and sensor gets a unique password at install. Anthropic notes Mirai spread on a list of factory defaults; the UK now bans them on new consumer devices.\n\n##### Patch or retire\n\nDevices whose makers no longer publish security updates are the cheap compute a replicator wants. Keep a list of what you own and what its update window is.\n\n##### Put IoT on its own network\n\nA compromised device on a separate segment cannot reach workstations, servers or the systems that hold customer data. Most business routers can do this already.\n\n##### Watch device-to-device traffic\n\nMulti-gigabyte transfers between devices that should never talk, or sustained chatter between them, is the network signature Anthropic describes. Alert on it.\n\n## 09 — ConclusionSigns of life, not a *sighting*.\n\n### Treat your connected devices as compute someone else might want, and fix the defaults, updates and segmentation before the forecast comes true.\n\nAnthropic's October 12 research shows that small open-weight models can already complete most of the individual steps needed to copy themselves across cheap internet-connected devices, that one larger model completed the whole chain in a simplified test, and that on the current trend a model small enough to run on those devices reaches that level around the end of 2026. The demonstration of a 26B model running on fifteen $55 TV boxes makes the hardware side of the argument hard to dismiss.\n\nIt also shows the limits. Everything was measured on networks Anthropic built, with the break-in made trivial, and the result is an upper bound by the authors' own description. A replicator of this kind would be slow, loud on the network and vulnerable to the same quarantine tactics that cleaned up Mirai. Nothing in the post reports one in the wild.\n\nThe practical response does not depend on whether the forecast lands in December or in two years. Remove default credentials, retire devices that no longer get updates, keep connected equipment off the networks that hold your data, and notice when devices start talking to each other. That advice predates AI. The research gives a business one more reason to finally act on it.", "url": "https://wpnews.pro/news/could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it", "canonical_source": "https://www.digitalapplied.com/blog/anthropic-ai-self-replication-iot-devices-research", "published_at": "2026-10-14 00:00:00+00:00", "updated_at": "2026-10-15 10:47:52.745345+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-research"], "entities": ["Anthropic", "William Zhou", "Daniel Freeman", "GLM-5.2", "Qwen3.5-9B", "Gemma4-26B-A4B", "Mirai", "Jetson Nano"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it", "markdown": "https://wpnews.pro/news/could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it.md", "text": "https://wpnews.pro/news/could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it.txt", "jsonld": "https://wpnews.pro/news/could-ai-copy-itself-onto-a-smart-oven-anthropic-tested-it.jsonld"}}