Anthropic says small AI models may soon copy themselves onto everyday devices

The post is dated Oct. 12, 2026. The byline is William Zhou and Daniel Freeman. They call the thing they are measuring a weight-based replicator: a model that carries its own weights, the file that makes it run, onto the next machine and then runs there.

They built one demonstration on hardware they bought. A model called Gemma4-26B-A4B ran across 15 off-brand Android TV boxes, about $55 each, at 0.39 tokens a second. A token is a small chunk of text. They split the model so each box held a few of its layers.

A separate test asked smaller models to get a different model, Llama 3.1 8B, serving on unfamiliar chips. A 9-billion-parameter model got that inference running on 8 of the 9 kinds of hardware they tried. Parameter is the count of numbers inside the model. The authors say the chips were a measuring stick, not a list of vulnerable products.

The end-to-end test used eight nodes inside a firewalled Google cloud network, each running an Android emulator. Patient zero started with the worm. Each later infection hopped over an Android debugging port with no password, copied the payload, and stood up an inference server. If that server passed checks, the worm spawned again. GLM-5.2 reached all eight nodes in four of five trials and seven of eight in the other. The other open-weight models they tried failed those full runs. The worm’s own larger model ran on a separate server, because the test machines were too small to run it. GLM-5.2 was setting up the smaller Llama model, not serving a full copy of itself on those boxes.

The authors say that open port makes the result an upper bound on what would happen on real devices. They note that an older botnet, Mirai, spread with default factory passwords, so they do not treat real gadgets as much harder than the test. That comparison is theirs.

On speed, they use the TV-box demo as a baseline. They estimate more than a day, and up to about two days, for a 9-billion-parameter copy to replicate. The opening summary calls that a doubling time of days. They also say a model that learns from its own notes got better at the setup task across generations, from 45 percent success on the first try to between 61 and 84 percent later. Giving a small model advice from a larger one did not measurably help.

Their forecast: models of 30 billion parameters and under can already do many of the steps, but they make mistakes when they chain them. If small models keep improving at the pace of a chart they fit, they match GLM-5.2’s showing by the end of 2026, and a small replicator could follow soon after. They call that chart a rough proxy, not a direct measure of replication. The line is their projection.

They do not claim a rogue replicator exists. The last section says they are seeing “signs of life,” the way coding agents looked in 2024, and that the form a real one would take is uncertain.