AI may soon learn something a little scary: to replicate itself.
Just yesterday, the Anthropic Frontline Red Team released a new study exploring whether AI, like computer viruses, can automatically replicate, run, or even continue to spread between different devices.
The researchers found that with the improvement of small model capabilities, AI has begun to have the ability to adapt to unfamiliar hardware, to autonomously deploy reasoning environments, and to continue to spread across networks. More importantly, these AIs may not have to rely on expensive data centers in the future to run ubiquitous IoT devices such as smart TVs, TV boxes, and even smart ovens.
Anthropic even predicts that by the end of 2026, at the rate at which the current small model's capabilities progress, 30B parameters and smaller models may reach the level of autonomous replication capability that the current large model exhibits in a simulated environment.
To verify this idea, the researchers did something surprising: run a large model of the 26B parameter using 15 cheap Android TV boxes.
15 cheap TV boxes.
I actually run a 26B model.
These TV boxes cost about $55 each, with only 4GB of memory, and were originally used only for ordinary consumer electronics for playing video. The researchers connected them together, disassembled the Gemma4-26B-A4B models into different devices, and used flow lines in parallel, allowing each TV box to calculate a portion of the model separately.
Eventually, the device, which cost around $825, actually ran a large model of the 26B parameter. Although it generated only 0.39 tokens per second, far below the level of a streamlined conversation, 15 TV boxes used to play video on a regular basis were able to share the reasoning tasks of the large model through distributed collaboration.
However, there is a barrier between running models and autonomous replication: AI must adapt itself to unfamiliar devices. Researchers allow different models to identify hardware environments, install dependencies, and modulate reasoning procedures. As a result, Qwen 3.5-9B successfully adapted 8 of the 9 hardware classes tested, including Jetson Nano, Mac, and other devices.
A small 9B model is already able to handle a considerable part of the deployment problem independently. So what if it starts from one device and finds the next device to continue deploying?
In simulated networks, AI has been able to communicate autonomously
Anthropic built a network of eight Android 15 simulation nodes in an isolated environment, and designated one of them as the starting point. AI needs to scan the network itself, find targets, establish connections, transmit files, and then configure reasoning services at new nodes to continue the copying process.
In the test, GLM-5.2 was the most prominent in five experiments, four of which were successful in spreading to all eight nodes, while the other one covered seven nodes. In contrast, smaller models, although able to complete some steps, have not been able to stabilize the entire spreading process.
However, GLM-5.2 did not run directly on these simulated devices. In the experiments, it still relied on independent reasoning server execution tasks, while the Llama3.1-8B reasoning service was deployed on the simulated nodes. In addition, the researchers also pre-opened unverified ADB ports, reducing the difficulty of accessing the device.
Even so, the differences between AI worms and conventional computer worms have begun to emerge. Conventional worms typically rely on pre-written attack codes and spread rules, while AI can adapt deployments to the hardware and software environments of different devices. Anthropic then tested another possibility: If AI could inherit a generation of operating experience, would it spread more skillfully?
It's a way for the next generation to replicate and inherit the experience.
If an AI encounters a dependency conflict in deployment and tries to solve it in several ways, can the next generation directly use that experience?
The research team allowed Qwen 3.5-9B to leave code, work records and problem-solving notes after each round of missions, and then hand over to the newly launched Agent to continue the experiment. After six generations of 20 independent experimental sequences, the first generation's success rate of deployment was only 45%, and subsequent generations improved to 61% and 84% respectively.
The weight of the model has not changed. What is really being passed on is the way the previous generation worked on it. Researchers have likened this mechanism to "Ramack evolution": the experience gained can be passed on directly to the next generation. For potential AI worms, a failed deployment may also be a clue to the next successful one.
The team also turned to Claude Opus 4.8 for help when faced with difficulties, without observing a statistically significant improvement in success rates. Compared to external suggestions, specific records from its predecessors, AI is more useful in this group of experiments. AI does not need to be retrained and may become more proficient in repetitive operations.
A key turning point could be at the end of 2026
At present, autonomous replication also falls between two thresholds: a large model such as GLM-5.2 can organize a more complete transmission process without being separated from external computing resources; smaller models such as Qwen 3.5-9B are easier to deploy but do not have the same stable transmission capabilities.
Anthropic estimates that by the end of 2026, small models may reach the current GLM-5.2 comprehensive capability level based on the 30B parameter and the following open source weight model capacity growth trends.
Broadcasting speeds are also limited. According to the rational performance estimates on cheap TV boxes, Gemma4-26B-A4B may take 71-150 hours to complete a deployment task, and Qwen3.5-9B 28-51 hours. They may not spread as quickly as conventional computer worms, but rather slowly to find equipment and expand networks.
Anthropic thus uses a metaphorical metaphor: "digital fungus". It does not have a central server, but may be scattered across a large number of inexpensive devices, gradually accumulating computational resources. At the same time, the transmission of model weights and continuous communication between devices will also produce abnormal traceable flows, providing clues to defense.
Currently, there is no fully autonomous replication system in the real world as described by the Institute. However, this study brings together a number of previously debated issues: models can run on cheap devices, can be organized and transmitted in simulated networks, and can pass on operational experience to the next generation.
When these capabilities are concentrated in the same small model, the security boundaries of AI may no longer remain within the data center.
The link is as follows:
© THE