Safety #Anthropic #Open models Oct 13, 2026 · Originally published Oct 12

Anthropic’s Frontier Red Team says small models may be months from self-replicating on IoT devices; a 9B model set up inference on 8 of 9 hardware types

A study of whether small open-weight models could act as a worm that carries its own weights and runs on cheap, poorly defended devices.

Primary source Anthropic Research (Frontier Red Team) · anthropic.com Read the original ↗

// Key points

The team ran Gemma4-26B-A4B split across 15 off-brand Android TV boxes (about $55 each) at 0.39 tokens per second.
In its evals a 9B model got inference running on 8 of the 9 hardware types tested; models of 30B and under can already complete many individual replication steps but make mistakes chaining them.
In simplified evals GLM-5.2 and stronger models replicate end to end; if small models keep improving at their historical rate, they reach that level by the end of this year.
Suggested defenses include ISP flow monitoring for multi-gigabyte model payloads and unusual device-to-device traffic, and secure defaults such as the UK’s ban on default IoT passwords.

Builder's takeThis is not just a datacenter problem: the same post lists stealing API keys to pay for inference as another replication route. I’d audit where our model API keys live this week, and put hard spending caps and usage-anomaly alerts on every inference account behind PandaClaws and the AI cloud drive. Read alongside the 10-11 report on unintended agent actions, the message is the same: constrain in infrastructure, not in prompts.

// Background · from #Anthropic

Full timeline →