# Anthropic Research: Small AI Models Could Autonomously Self-Replicate Across Poorly Secured IoT Devices

> Anthropic's Frontier Red Team demonstrated that open-weight AI models of 30B parameters or fewer can act as autonomous worm agents that discover devices, gain access, set up model inference on the new host and repeat. In lab tests on poorly secured Android TV boxes, GLM-5.2 spread to all 8 nodes in 4 of 5 trials. No real-world exploitation or threat actor is reported; this is a research demonstration of a theoretical capability.

- **Published:** 2026-10-13T15:23:14Z
- **Last reviewed:** 2026-10-13T19:05:12.628Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3418
- **ID:** TL-2026-3418
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-12 Anthropic's Frontier Red Team (William Zhou, Daniel Freeman) published research titled 'AI models may be capable of self-replicating without access to a datacenter'. The work asks whether small, open-weight models can replicate across networks of cheap internet-connected devices without datacenter infrastructure. The researchers decomposed replication into four stages: network enumeration, initial access, inference setup, and payload propagation (the new host runs the model, which then repeats the cycle). They concentrated their measurements on inference setup, using a custom agent harness called Memento built on the open-source Pi coding agent. Memento counters agent fixation by spawning fresh agent instances that inherit notes from earlier attempts, which lets the agent change strategy (described as Lamarckian-style inheritance of prompts and code).

Hardware covered 15 off-brand Android TV boxes (about $55 each, 1-4GB RAM) networked for distributed inference using pipeline parallelism (each box holding a segment of model layers, chosen for fault tolerance), plus Jetson Nanos, Mac PCs, RTX 4090s and various ARM Cortex-based devices; NVIDIA edge accelerators (AGX Orin, AGX Thor) and IoT such as smart cameras were discussed as reachable populations. Autonomous replication trials ran on 8 GCP nodes running redroid (an Android 15 emulator). Models evaluated included Qwen3.5-9B, Gemma4-26B-A4B, GLM-5.2 and Llama3.1-8B, with Opus 4.8 used as a 'frontier advisor' that gave no measurable improvement. GLM-5.2 was the only tested open-weight model capable of full end-to-end replication, infecting 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the remaining trial. A 9B-parameter model set up inference on 8 of 9 hardware types. A Qwen3.5-9B lineage improved inference-setup success from 45% to 61-84% across six generations of inherited notes. Gemma4-26B-A4B distributed across 15 TV boxes ran at 0.39 tokens/second; complete replication cycles were estimated at 28-51 hours for 9B models and 71-150 hours for 26B models. Agent competence degraded with context windows below 32K tokens.

The access stage was deliberately simplified: the experiments used unauthenticated Android Debug Bridge (ADB) ports as the entry vector, which the authors acknowledge is unrealistic for hardened systems. Models scanned networks with ordinary command-line tools, determined compatible inference frameworks, resolved package dependencies and debugged environment-specific problems. Spearphishing capability remains limited in models under 100B parameters and social engineering was deliberately excluded. The authors project, using Epoch Capabilities Index trends (13.7 ECI/year, R2=0.95), that smaller models could reach GLM-5.2-level capability by the end of 2026. Their estimate of edge-accelerator reach (9,000-35,000 H100-equivalents) is acknowledged as likely overestimated.

The authors frame the risk against Mirai (default-credential IoT botnet) and Kimwolf (an Android variant of AISURU active since at least August 2025 that has taken over more than two million non-certified Android TV boxes, many sold pre-infected or with ADB enabled by default and reached through residential proxy network weaknesses; roughly 67% of devices in proxy pools were reported unauthenticated). An equivalent AI-replicator fleet of Kimwolf size is estimated at about 133K replicas serving about 80K tokens/s. Unlike hard-coded botnets, an AI replicator needs no device-specific programming and can adapt across heterogeneous hardware and operating systems. Recommended defenses are ISP flow-based monitoring for multi-gigabyte transfers and anomalous device-to-device traffic, quarantining infected subscribers to restricted whitelists (92% of Mirai infections cleared within 14 days versus 74% without notification), honeypots to capture replicator harnesses and payloads, and manufacturer hardening such as banning default passwords (as in the UK) and mandatory firmware updates. The research measures agent competence at orchestrating replication, not malicious intent, and no in-the-wild exploitation, CVE, or attribution is reported.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1570 Lateral Tool Transfer
- T1059.004 Unix Shell
- T1496.001 Compute Hijacking
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer

## Sources

- [AI models may be capable of self-replicating without access to a datacenter (Anthropic Frontier Red Team)](https://www.anthropic.com/research/self-replicating-ai)
- [Anthropic Shows How Small AI Models Could Replicate Across IoT Devices (Security Affairs)](https://securityaffairs.com/200880/ai/anthropic-shows-how-small-ai-models-could-replicate-across-iot-devices.html)
- [Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices (Security Affairs)](https://securityaffairs.com/186559/malware/kimwolf-botnet-leverages-residential-proxies-to-hijack-2m-android-devices.html)
- [Kimwolf Android Botnet Infects Over 2 Million Devices (The Hacker News)](https://thehackernews.com/2026/01/kimwolf-android-botnet-infects-over-2.html)
- [The Kimwolf Botnet is Stalking Your Local Network (Krebs on Security)](https://krebsonsecurity.com/)
- [Kimwolf Android Botnet Grows Through Residential Proxy Networks (SecurityWeek)](https://www.securityweek.com/kimwolf-android-botnet-grows-through-residential-proxy-networks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3418