Anthropic 紅隊稱小型 AI 模型或於 2026 年底達到 IoT 自我複製能力門檻

Anthropic’s Frontier Red Team published research on October 12, 2026 reporting that small AI models may be months away from being capable of self-replicating on commercial IoT devices such as smart ovens and off-brand Android TV boxes, and that such a replicator would be challenging to shut down because it has no centralized point to shut off.

In the post, authors William Zhou and Daniel Freeman report that a 9-billion-parameter model got inference running on eight of the nine hardware types the team tested, and that models of 30 billion parameters and under can already complete many individual steps of replication, though they make mistakes when composing the steps end to end. If small models keep improving at their historical rate, the team projects they will match the required capability level by the end of 2026, with small weight-based replicators possible soon after, though it notes replication may be slow, with a doubling time of days.

Distributed Inference on Smart TV Boxes

To show that expensive accelerators are not strictly necessary, the team bought and networked 15 off-brand Android TV boxes costing about $55 each, then ran Gemma4-26B-A4B, a 26-billion-parameter model, sharded across the fleet under pipeline parallelism with each 4-gigabyte-RAM box holding a small fraction of the model’s layers. The team reports the setup served 0.39 tokens per second, and writes that a distributed botnet of cheap, typically poorly defended IoT devices could provide enough compute to run a capable model.

Threat Models and Evaluation Design

The post frames the concern as autonomous replication and adaptation (ARA), decomposing replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. The researchers largely excluded the cyber-exploit stages, citing earlier papers including CyberGym, ExploitBench, and work on adaptive worms as showing that small models are already capable of cyber exploits, and focused on inference setup, which they describe as the least studied and possibly most challenging stage for small models.

The post describes three threat models as closest to realization: a small weight-based replicator spreading by compromising host machines; a large, advanced weight-based replicator targeting datacenters and other high-compute systems, in frontier and open-weight variants; and an API-based replicator stealing credentials for its own inference API. Weight-based replicators do not need root privileges, the researchers note, because inference engines can run entirely in userspace, and they cite crypto miners and botnets such as P2Pinfect and Fritzfrog as operating without privilege escalation.

Experiments ran on Memento, a harness the team built on the open-source Pi coding agent, which periodically starts a fresh agent instance that inherits its predecessor’s workspace and a short set of notes on what it tried. In the serving experiment, each model had a 1.5-hour limit per iteration and a six-hour total timeout. The representative threat model is Kimwolf, a botnet the post identifies as having infected more than two million devices, primarily off-brand Android TVs. Such boxes typically ship with one to four gigabytes of RAM, and at four gigabytes with 4-bit quantization, the post calculates, 9-billion-parameter models can run across four or more machines and 26-billion-parameter models across ten or more.

End-To-End Replication Results

To test whether models can chain the full cycle of scanning for targets, gaining access, delivering the payload, and standing up inference, the team built a firewalled virtual private cloud of eight Google Cloud nodes running redroid, an Android 15 emulator. A patient-zero worm hopped node to node over an unauthenticated ADB port and set up an inference server serving Llama3.1-8B, with correctness and anti-cheating checks gating each new copy.

Only GLM-5.2 among the open-weight models tested achieved full end-to-end replication, spreading to all eight nodes in four of five trials and to seven of eight in the remaining trial, the team reports. Because the evaluation keeps the cyber step trivial, with no authentication on the ADB port, the researchers describe the result as an upper bound on real-world success, while noting that past IoT botnets such as Mirai spread through default lists of manufacturer usernames and passwords.

The post defines a capabilities floor a worm must exceed to replicate reliably, with GLM-5.2 above it, and a size ceiling a model must stay under to run on the devices it attacks; Qwen3.5-9B and Gemma4-26B-A4B sit under that ceiling for the 4-gigabyte smart TVs tested, and the two do not currently intersect. Plotting notable open-weight models of 30 billion parameters or fewer against the Epoch Capabilities Index, the team’s least-squares fit shows a gain of 13.7 ECI per year with an R² of 0.95, placing a small model at GLM-5.2’s level by the end of 2026, though the team cautions that ECI is a general capability index and only a proxy for replication ability, making the timing a rough estimate. In a 17-node ablation with inference setup handled by a pre-written script, even a 3-billion-parameter model reached about half the nodes, which the team says bounds how much difficulty lies in the remaining autonomy and orchestration steps.

Replication Speed, Scale, and Adaptation

In the team’s measurements on the physical TV boxes, unoptimized Gemma4-26B-A4B inference ran at about 0.3 tokens per second across a 32,000-token context window, and a full inference setup took 71 to 150 hours, versus 28 to 51 hours for Qwen3.5-9B. Scaled to a fleet the size of Kimwolf, the team estimates roughly 133,000 replicas, each a group of 15 TVs, serving about 80,000 tokens per second in aggregate, at most about 40 H100-equivalents of inference, which the team calls a tiny amount of compute, with replication taking one to two days per 9-billion-parameter copy.

Across six generations of Qwen3.5-9B instances that each inherited a predecessor’s notes, inference-setup success rose from 45% in the first generation to between 61% and 84% in later generations across 20 lineages, the team reports. Giving Qwen3.5-9B access to Opus 4.8 as a frontier advisor did not measurably help, whether offered as a tool call or given unprompted, and reinforcement learning to use the advisor on coding tasks did not transfer productively. In a local replication of Meta’s CyberSecEval 3 spear-phishing evaluation, small models scored at levels the post characterizes as very poor to poor when normalized to human raters, which the team cites as evidence that social engineering lags agentic cyber capability in small models.

The post separately estimates on the order of 90 distinct NVIDIA-silicon IoT product lines and roughly 9.5 million fielded units, a very rough 9,000 to 35,000 H100-equivalents of compute in edge accelerators, with the reachable share likely an order of magnitude or more lower. A Jetson AGX Orin 64GB runs Qwen3-30B-A3B at 76.7 tokens per second and an AGX Thor reaches 226 tokens per second, according to figures the post cites.

Defenses and the Team’s Assessment

Defense involves driving R₀, the number of new devices each infected device goes on to infect, below one, the post states. A weight-based replicator multiplying through IoT machines at scale would leave a network signature visible in ISP flow-based monitoring, since newly infected hosts receive multi-gigabyte model payloads and distributed inference produces sustained device-to-device traffic; faster replication produces more traffic, trading speed against stealth; and honeypots can capture a replicator’s harness and payload. Citing Mirai remediation research, the post states that ISP quarantining with customer notification cleared 92% of infections within 14 days, against 74% without notification, and notes that default IoT passwords are now non-compliant in UK markets as an example of regulation shrinking the target pool.

Unlike hard-coded botnets such as Kimwolf, which target specific device types, an AI botnet is not tied to particular hardware, the post states, pointing to small models setting up inference on machines from a Jetson Nano to a Mac. The researchers conclude that, as with coding agents in 2024, the findings show signs of life for AI worms, with agents increasingly completing individual steps of the replication chain and passing adaptations to future copies, but not yet a full rogue replicator, and they expect deployed edge compute to keep growing while the minimum model size required for reliable replication falls.