Anthropic's Frontier Red Team published a study on October 12 concluding that open-weight models of modest size may be capable of self-replicating within months on cheap internet-of-things devices, such as Android TV boxes that cost a few dozen dollars. The authors, William Zhou and Daniel Freeman, call this kind of program a “weights-based replicator”: a model scans the network, breaks into devices, copies its own weights over, sets up an inference service on the new machine, and keeps spreading from there.
The paper puts it this way:
“may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices”
Testing the process in four steps
The study breaks replication into separate stages. The first is deploying inference on unfamiliar hardware. Qwen3.5-9B got inference running on its own on 8 of 9 hardware types, ranging from a Jetson Nano to Macs and an RTX 4090, with each run taking 28 to 51 hours. The larger Gemma4-26B-A4B was split across 15 Android TV boxes, each costing about $55 and carrying 4GB of memory. It ran at roughly 0.3 tokens per second, and the full deployment took 71 to 150 hours.
The second stage is end-to-end replication. The team built an 8-node simulated network on Google Cloud and asked the model to do everything in one go: scan, break in, transfer weights and deploy inference. Among open-weight models, only GLM-5.2 completed this reliably. In 5 trials it reached all 8 nodes four times and 7 nodes once. Models below 30B parameters could finish most single steps but made errors once the chain grew longer.
The third stage tested “generational learning.” Qwen3.5-9B passed notes left by one generation to the next, across 6 generations and 20 lineages. The success rate rose from 45% in the first generation to between 61% and 84% in later ones. The researchers also tried having Claude Opus 4.8 advise the small model, and saw no significant improvement.
Scale and speed
Using the Kimwolf botnet as a reference, Anthropic estimated that if more than 2 million devices of this kind were infected, roughly 133,000 model copies could run, with combined throughput of about 80,000 tokens per second, equivalent to around 40 H100 GPUs. Such a network would have no central node and would be hard to cut off in one move, but it would spread slowly, and doubling the number of copies would take several days.
The authors list several limitations. The intrusion step in the experiments was simplified to an ADB debugging port with no authentication, so the success rates should be read as an upper bound. The ECI used to extrapolate the trend is a general capability index and does not directly measure replication ability. Speed and scale rest on a single hardware type and one historical botnet. The scenario in which an AI botnet faces active defenders was not tested. On the quality of phishing emails written by small models, the study's assessment ranges from “very poor” to “poor.”
What this means for China
The main models in the tests, Qwen from Alibaba and GLM from Zhipu AI, are open-weight releases from Chinese vendors. The study does not say these models are flawed. It relies on exactly the traits that make them attractive: strong capability and the ability to run locally. Neither company has publicly responded to the study so far.
The Android TV boxes, projectors and other set-top devices used as hosts are common in Chinese homes, and security researchers have warned for years about units that ship with debugging ports open and default passwords unchanged. The UK has legislated to ban default passwords on IoT devices; in publicly available material, China does not yet appear to have a mandate of comparable strength.
The defensive recommendations follow lessons from the Mirai era: carriers watch for abnormal traffic, isolate infected users and notify them so they can clean up. That approach cleared 92% of infections within 14 days, against 74% in a control group that was not notified. Anthropic's stated goal is to push the replicator's reproduction number, R₀, below 1.
The study includes one more data point: if the deployment step is replaced with a hard-coded script, even a 3B-parameter model can cover about half of the machines in a 17-node network. The smaller the model, the easier it is to fit onto a device, and how far that line moves will depend on the size of the next round of open small-model releases.
Sources: Anthropic Frontier Red Team research blog, CocoLoop, and the study page, checked for model parameter counts, hardware types, success rates, generational success rates and the Kimwolf scale estimate.