On October 12, 2026, Anthropic published research examining whether AI could autonomously replicate itself using inexpensive IoT devices. Its frontier red team combined 15 Android TV boxes, each costing about $55, and succeeded in running a large AI model on them. In a separate experiment with a more capable AI model, the team confirmed that it could carry out the full sequence of steps needed for self-replication in a simplified environment. The researchers predict that if small AI models keep improving at the historical pace, they could reach the level needed for autonomous self-replication as early as the end of 2026.
The research shows that it is not only data centers with expensive GPUs that could be abused as computing resources for AI. Widely deployed devices with limited processing power, such as those found in homes, could be used too. However, what was demonstrated was AI running on inexpensive real hardware, and the execution of replication steps in a simplified environment. An AI did not break into real IoT devices and keep multiplying on its own. The results need to be read with that difference in mind.
A 26-billion-parameter AI runs on 15 Android TV boxes at $55 each
Anthropic's William Zhou and Daniel Freeman, who led the research, used Android TV boxes from an obscure manufacturer, each available for about $55.
Each device has 4GB of memory. By connecting 15 of them over a network, the team ran "Gemma4-26B-A4B," an AI model with about 26 billion parameters, at 0.39 tokens per second.
A token is the unit an AI uses when processing text. At 0.39 tokens per second, the speed is extremely slow compared with a typical chat AI. Even so, it is significant that inference on a large AI model could be run using only inexpensive devices without high-performance dedicated GPUs.
A demonstration of the setup in operation is available in Anthropic's research report.
That said, the full 26-billion-parameter model was not run on each of the 15 devices.
The team used a technique called "pipeline parallelism," which splits an AI model across multiple devices.
The layers that make up the model are divided among the devices, and each device passes its results to the next in sequence, so several machines together run a single model.
The team also reduced the memory required by quantizing the trained model's parameters to 4 bits.
By the researchers' estimates, running a model of about 9 billion parameters on devices with 4GB of memory requires at least four devices, and a model of about 26 billion parameters requires 10 or more.
Distributed inference of this kind has been studied for some time.
For example, the Petals research published by Borzunov and colleagues proposed a system in which multiple participants share the processing of an AI model's layers. If a server handling a given part stops, the system is designed to find another server and continue processing.
Anthropic also cites the ease of moving work from a failed device to another as one reason for adopting pipeline parallelism.
However, being able to run AI distributed across multiple devices is a completely different capability from an AI finding new devices by itself and autonomously increasing its copies.
What the real-hardware demonstration directly proves is that a large AI model can be run by combining inexpensive, everyday devices.
Self-replication test succeeds on 8 of 8 nodes, but with important constraints
Anthropic also tested the abilities an AI needs to replicate itself onto new machines.
The model that performed well in this experiment was "GLM-5.2."
In an isolated eight-node test environment built on Google Cloud, GLM-5.2 completed the replication procedure on all eight nodes in four of five trials. In the remaining trial, it reached seven of the eight nodes.
However, the experiment had important conditions.
First, the targets were not actual Android TV boxes but "redroid," an emulator running Android 15.
In addition, ADB (Android Debug Bridge), which is used to operate the devices, was configured to accept connections without authentication, so the difficulty of accessing the devices was deliberately kept low.
Furthermore, the model actually run on the destination devices was not GLM-5.2 itself but "Llama 3.1 8B."
GLM-5.2 played the role of directing the replication work, and its inference server ran in a separate location from the target nodes.
After confirming that Llama 3.1 8B ran correctly on a new node, launching a copy of the agent on that node was also handled by a mechanism the research team had prepared.
In other words, GLM-5.2 did not succeed in copying itself onto inexpensive IoT devices and operating fully autonomously there.
The experiments Anthropic published, and the content and limits of each, can be summarized as follows.
| Experiment | Models and environment | What was confirmed | Main constraints |
|---|---|---|---|
| Distributed inference on real hardware | Gemma4-26B-A4B run on 15 TV boxes | Large AI can be run by combining inexpensive devices | Researchers purchased and connected the devices. Autonomous infection was not tested |
| Setting up inference environments on different devices | Models such as Qwen3.5-9B built environments to run Llama 3.1 8B | Qwen3.5-9B succeeded in setting up on 8 of 9 types of hardware | Did not measure the ability to break into actual devices |
| Self-replication test on 8 nodes | GLM-5.2 on an external server deployed Llama 3.1 8B | Carried out the full sequence from finding targets to setting up the inference environment | ADB had no authentication. Launching the agent on the destination was handled by the researchers' mechanism |
| End-of-2026 capability forecast | Analyzed capability trends of models with 30 billion parameters or fewer | Estimated that small models could reach the capability level needed in the future | Did not demonstrate when self-replication would become feasible in real IoT environments |
The above summarizes the experimental conditions described in Anthropic's research report. Success rates from different experiments cannot be compared directly as a performance ranking of the models.
What was confirmed is that small AI can run on inexpensive real hardware, and that a powerful AI can carry out the steps of self-replication in a simplified environment. The ability of a small AI to keep multiplying autonomously using only IoT devices has not yet been demonstrated.
This distinction also matters when comparing with earlier research.
The preprint "AI Agents Enable Adaptive Computer Worms" by Guan and colleagues examined the ability of AI to spread infection within a simulated corporate network while assembling steps tailored to each target.
However, the main infection-spread experiments used an inference infrastructure built on shared GPUs. The ability to run an AI model on new GPUs was tested in a separate experiment in which the AI was given administrator credentials.
In other words, prior research has also evaluated separately the ability to spread across a network and the ability to secure the computing resources needed to run itself on the infected machine.
Anthropic's research is distinctive in extending the latter to IoT devices with limited computing power.
The results were published as an Anthropic research blog post, not a peer-reviewed paper. They are not a report that an out-of-control AI has been found on actual household devices.
Small AI could gain self-replication ability as early as the end of 2026
Anthropic's "end of 2026" forecast was not derived directly from the success rates in the self-replication experiments.
It is based on an analysis of how quickly the general capabilities of small AI models have improved so far.
The research team looked at open-weight models with 30 billion parameters or fewer and examined the capabilities of the top-performing models at each point in time.
The measure they used was the "Epoch Capabilities Index (ECI)," developed by Epoch AI.
According to Epoch AI's explanation, the ECI, which measures general capability, is calculated by combining more than 50 benchmarks. A separate ECI that measures cybersecurity capabilities exists apart from the general-capability index.
In Anthropic's analysis, the general capability of small models has improved at a pace of 13.7 points per year.
If that trend continues, small models with capabilities equivalent to today's GLM-5.2 would appear by the end of 2026.
There is, however, considerable uncertainty here.
Even if general AI capability improves, that does not mean the AI can carry out every step needed for self-replication on real networks with authentication and communication restrictions.
Anthropic itself describes the forecast as a rough estimate that uses a general-capability index in place of self-replication ability.
There is also a difference between being able to perform individual tasks and succeeding at multiple steps in a row.
For example, to run an AI model on an unfamiliar device, one must choose software that supports the device, install the necessary libraries, and track down the cause of any errors.
The research also reports a case in which a Qwen model kept checking package versions for a long time, while the actual problem was an implementation incompatible with the verification API.
Once an AI settles on a wrong cause, it may keep investigating in the same direction and fail to reach a solution.
To address this problem, the research team used an agent execution framework called "Memento."
Memento launches a new agent at regular intervals and hands over the code and work notes created by the previous agent.
This makes it easier for a new agent to try a different approach even if the previous agent had gotten stuck.
In the experiment testing inference-environment setup, each run was limited to a maximum of 1.5 hours and the total to 6 hours, and information such as device specifications was provided in advance.
In other words, the results reflect not only the capability of the AI models themselves but also the effect of such work-support mechanisms.
The team also tested how success rates change when work notes are passed on to the next agent.
Using Qwen3.5-9B, they ran 20 lines of agents over six generations, and the success rate for setting up the inference environment rose from 45% in the first generation to 61–84% in later generations.
However, this resulted from passing on knowledge gained by earlier agents as work notes; it was not that the model's weights were retrained and its capability itself evolved.
On the other hand, in an experiment where agents could ask the more capable "Claude Opus 4.8" for advice, no statistically significant improvement was observed.
The small model could not formulate the right questions, and even when it received advice from the stronger model, it could not make enough use of it to solve the problem.
These results suggest that what self-replication requires is not merely access to a powerful AI.
The ability to identify the cause of a failure, change course as needed, and carry out the whole sequence of tasks to the end is what matters.
Self-replication may be slow, but it could be hard to stop
Even if a small AI became able to replicate itself on IoT devices, it might do so very slowly.
Anthropic combined the real-hardware measurements from this study with the amount of processing required in the inference-environment setup experiments to estimate how long it would take an AI to prepare an inference environment on a new device.
The results are as follows.
| AI model | Estimated time needed to set up the inference environment |
|---|---|
| Qwen3.5-9B | About 28–51 hours |
| Gemma4-26B-A4B | About 71–150 hours |
These estimates assume conditions in which inference and processing of work history are repeated with a context of about 32,000 tokens.
However, they are estimates that combine inference speeds measured on real hardware with workloads measured in a different environment.
They are not measurements of how many hours it would take for the number of infected devices to double on a real network.
Still, slow propagation does not mean the threat can be dismissed.
What Anthropic focuses on in this research is that an AI model's weights and runtime environment can be moved to each device and inference run on that device.
With a system that relies on a cloud AI service, the provider can revoke an API key and at least stop access to that API.
But when the AI model itself is running on infected devices, revoking a particular API key cannot stop it.
As long as devices that can perform computation and communication paths remain, processing may continue.
Anthropic compares such AI to a "digital slime mold."
The idea is that even if each individual process is slow, it could keep operating tenaciously across a network by using distributed computing resources.
Vulnerable IoT devices being pulled into large botnets is already happening in reality.
In its investigation of the Kimwolf botnet, published in January 2026, the security firm Synthient reported that the number of infected devices exceeded 2 million.
The main targets of infection were Android devices on which ADB was accessible.
Residential proxy networks routed through home internet connections were also abused, creating paths that could reach devices not directly accessible from outside.
This case shows that devices in the home are not necessarily safe just because they are not directly exposed to the internet.
However, discovering a device on a network, breaking into it, and running an AI model on it once inside are separate problems.
Just because an AI model could be run on Android TV boxes does not mean the same break-in would work on smart ovens or robot vacuums.
Anthropic's warning is that as AI capabilities improve and AI becomes able to build runtime environments suited to unfamiliar devices, even devices once considered too much trouble to attack could be continually targeted.
How do you stop self-replicating AI? Network monitoring and the role of ISPs
Even if AI begins replicating itself autonomously, it does not mean there would be no way to defend against it.
Anthropic points out that the traffic generated when transferring AI model weights or running distributed inference across multiple devices could serve as a clue for detection.
Weights for large AI models can reach several GB, so copying a model to a new device requires transferring a large amount of data.
If devices that do not normally exchange large amounts of data start communicating continuously, that itself could be detected as abnormal behavior.
Trying to speed up self-replication also increases the traffic involved in discovering devices and transferring data.
As a result, spreading quickly and avoiding detection by network monitoring can be difficult to achieve at the same time.
As the party that can monitor such traffic, internet service providers (ISPs) have an important role in countermeasures.
In fact, with conventional IoT botnets, there are examples in which ISPs quarantining infected devices and notifying users proved effective.
In research on Mirai botnet disinfection presented at NDSS 2019 by researchers from Delft University of Technology, Yokohama National University, NICT and others, the approach tested was to temporarily restrict infected users' internet connections and guide them on how to respond.
As a result, among 40 users whose connections were quarantined and who were notified, the disinfection rate after 14 days reached 92%.
By comparison, it was 74% among 43 users who received no notification, and 77% among 40 users who received only an email notification.
Email notification alone showed no statistically significant difference from the group that was not notified.
These results suggest that it can be effective not only to tell users about an infection but also to restrict connections on the network side and prompt a response.
However, this is a finding about the conventional Mirai botnet, and the same 92% disinfection rate would not necessarily apply to AI-driven self-replicating malware.
Still, it is an important precedent in that ISPs and users can work together to intervene against malware that spreads in a distributed way.
If AI replicates itself, it may become necessary to identify the owners of infected devices and implement countermeasures across multiple ISPs and device manufacturers.
It is also conceivable that an AI could analyze defenders' responses and change its behavior accordingly.
However, Anthropic did not test in this research whether an AI could actually adapt to and evade defensive measures.
Is the era of self-multiplying AI near?
The research showed that even inexpensive IoT devices can run a large AI model, and that a high-performance AI can carry out the full set of tasks needed for self-replication in a simplified environment.
However, these two capabilities have not been fully combined in a single small AI model.
At present, there is still a gap between the capability of small models that run on inexpensive devices and the capability a model needs to complete self-replication reliably.
Anthropic predicts that if AI progress continues at the historical pace, the gap could close as early as the end of 2026. But this is an estimate based on the trend in general capability improvement, and it does not pin down when self-replicating AI will actually appear.
The key question for future testing is whether a small AI can autonomously carry out everything from discovering a new device to breaking in, setting up the inference environment and replicating to the next device, without help from a powerful external model or researchers.
At the same time, defenders also need to prepare.
Mechanisms that monitor the heavy traffic of model-weight transfers and unusual device-to-device communication, and isolate suspected devices from the network, are likely to be important.
Until now, IoT security measures have centered on responding to malware and botnets that exploit known vulnerabilities. But if AI becomes able to assemble its own procedures to suit unfamiliar environments, responses different from those used against conventional attacks may be needed.
Anthropic's research does not show that such a future has already arrived. Even so, the fact that both the ability to run AI on inexpensive devices and the ability to replicate autonomously have begun to be demonstrated is an important warning for thinking about the future of cybersecurity.