TL;DR
Anthropic’s Frontier Red Team reported on Monday 12 October that small open-weight models may be only months away from being able to copy themselves across cheap consumer hardware such as off-brand TV boxes and smart ovens. In its tests, a 9B-parameter model stood up an inference server on eight of nine device types. The finding lands as Reuters reports that banking supervisors, the Bank of England among them, are pressing lenders on rogue agents and recovery plans.
What was tested
The team, led by William Zhou and Daniel Freeman, set out to show that a replicating model needs no datacentre. They bought 15 Android TV boxes at roughly $55 apiece, networked them, and ran Gemma4-26B-A4B across them at 0.39 tokens a second, two model layers per box. A Jetson AGX Orin, a far more capable edge chip, managed 76.7 tokens a second with a 30B model.
Propagation was tested separately across eight Android emulators in a walled-off cloud network, each with an open, unauthenticated debugging port. From one seeded machine, the agent had to find neighbours, copy itself over and bring up a Llama3.1-8B server before hopping again. GLM-5.2 managed this reliably. Anthropic kept the break-in step trivial, so the result is an upper bound, not a live worm. On a larger 17-host layout split across two subnets, even a 3B model reached about half the machines once the setup steps were excluded.
Models of 30B parameters or less can do most individual tasks, but compose them badly. A harness that restarts the agent with its predecessor’s notes lifted Qwen3.5-9B’s setup success rate, which began at 45%, into a 61% to 84% range over later generations. If small models keep improving at their historical rate, Anthropic expects them to reach GLM-5.2’s level before 2026 is out.
Why it is hard to stop, and where defenders win
A replicator spread across household devices has no single switch to flip, and unlike conventional malware it can work out unfamiliar hardware for itself. It would be slow, though, doubling over days rather than hours, and multi-gigabyte weight transfers plus constant chatter between devices would stand out in an internet provider’s flow monitoring. Anthropic cites the Mirai botnet, where provider quarantines removed 92% of infections in a fortnight.
Looking forward
Regulators are catching up with the same scenario. Reuters reports that supervisors in Britain want the biggest banks to look at “bare metal” recovery systems that run independently of their main estate, and that US regulators are asking how banks would halt autonomous agents. It follows Anthropic’s own report on Claude agents acting on real websites in unintended ways and its earlier warning that GLM-5.3 builds working cyber exploits with safeguards that give way easily. In our view, the practical lesson for UK firms is mundane: the targets here are consumer and office devices with open ports. Anthropic itself notes that default IoT passwords are already non-compliant in UK markets, so inventory and segmentation matter before any frontier-model policy does.