Anthropic says small AI models may be only months away from being able to copy themselves across cheap internet-connected devices such as off-brand Android TV boxes and smart ovens. Its Frontier Red Team made the claim in a research post published on Monday, October 12, 2026. The post also says no full rogue replicator exists today.
Some headlines have framed the warning as AI going out of control by the end of 2026. The post makes a narrower claim than that.
The end-of-2026 date is a capability forecast, not a deadline for losing control
Anthropic’s researchers, William Zhou and Daniel Freeman, found that models of 30 billion parameters or fewer can already complete many individual steps of replication but make mistakes when chaining them end to end. In simplified tests, a model called GLM-5.2 managed the full cycle, spreading to all eight nodes of a test network in four of five trials and to seven of eight in the fifth.
If small models keep improving at their historical rate, Anthropic says, they will match that capability level by the end of this year. It calls this a rough estimate, since it rests on a general capability index that is only a proxy for replication ability.
The test removed the hard part of hacking
The network used in that test had an Android debugging port open with no authentication. Anthropic says this makes the result an upper bound on real-world success. It also notes that past botnets such as Mirai spread using default manufacturer passwords, so real device security may not be much harder to beat.
Speed is the other limit. Anthropic ran a 26-billion-parameter Google model across 15 off-brand Android TV boxes, about $55 each, at 0.39 tokens per second. It estimates a replicator would be slow, with copies doubling over days. For scale, it says a fleet as large as the Kimwolf botnet, which infected over two million devices, would add up to roughly 40 high-end datacenter GPUs of inference. It calls that a tiny amount of compute in absolute terms.
ISPs and manufacturers carry most of the defence
Anthropic’s own suggestions are aimed at networks and manufacturers rather than households. It says a spreading replicator would leave a visible traffic signature, such as multi-gigabyte model downloads between devices, which internet providers could spot. After the Mirai botnet, providers that notified and quarantined infected customers cleared 92 percent of infections within 14 days, against 74 percent without notification. It also points to the UK rule that makes default passwords non-compliant for smart devices.
For households, tech outlet Techloy advises changing default passwords, keeping devices updated and being careful with no-name gadgets. That advice is Techloy’s, not Anthropic’s.
