Small AI models may be months away from copying themselves onto ordinary devices

Anthropic did not find a worm already loose on the internet. William Zhou and Daniel Freeman report lab tests. They split replication into four steps: find a target, get the program running there, start the model, and jump again. They largely set the break-in aside. Earlier work, which I have not read, had already tested small models on software holes. Their own question was the less measured one: can a small model get a model running on a machine it does not know.

On that narrower test, Qwen3.5-9B set up an inference server, the software that lets a model answer, on 8 of the 9 kinds of hardware they tried, from a small Nvidia board to a Mac and a gaming PC. The chips are named so the result can be checked. Anthropic says the chips themselves are not the risk. The full cycle, find a machine, copy the payload across and start the model, only worked reliably for a stronger open model, GLM-5.2. In a closed test network of eight Android emulators, it reached all eight in four out of five runs, and seven in the fifth. The other models missed that full cycle as a rule. The door was left open on purpose: an administration port with no password. Anthropic calls the result an upper bound. GLM-5.2 itself did not run on those small machines. It ran on another server. The test asks whether a small model with that same skill could carry itself. That has not been shown.

Those two limits still do not meet. GLM-5.2 sits above the skill they measured. Qwen3.5-9B and a larger demo model, Gemma4-26B-A4B, are small enough for the cheap TV boxes they bought, about 55 dollars each, with 4 gigabytes of memory. A 9-billion model needs four or more of those boxes. The 26-billion demo ran across 15 of them, at 0.39 tokens a second. A token is a small piece of text. By their measurement, setting the 9-billion model up for the next jump takes one to two days. They fit a line through open models of this size, 13.7 points a year on a general capability index, and that line puts a small model at GLM-5.2's level by the end of 2026. They say the index is only a proxy, and the date is a rough estimate.

A copy can get better without a person rewriting it. Each run of Qwen3.5-9B left short notes, and the next copy inherited them. The share that finished the setup rose from 45 percent in the first generation to between 61 and 84 percent later. Giving the small model advice from a much stronger one, Opus 4.8, did not measurably help. Anthropic's own closing line is that these are signs of life, and that a full rogue replicator does not exist yet.

The same weekend, attackers heated the fridges of French supermarkets, and Ahold Delhaize took systems offline at Albert Heijn and Delhaize. That piece is here: the supermarket attacks. Anthropic names smart fridges as a machine that could hold part of a small model. The French attack was on industrial refrigeration controllers, and no report says a model did it. The paper is why the two are being read together. It does not identify an attacker. A case where a person did use AI tools against real organisations is the South Korean banks.

I read the blog post, including the appendices as they appear on the page. I did not rerun the tests, and I did not read the earlier exploit papers Anthropic points to, nor Synthient's count of the Kimwolf botnet. The end-of-2026 date is their line through a general index, which they call a rough proxy. The break-in in the replication test was made trivial on purpose.