On 12 October 2026, Anthropic's Frontier Red Team published research arguing that small open-weight models may be months from copying themselves onto cheap, poorly secured internet-of-things (IoT) hardware. Reuters, via Khaleej Times reported that the experiments covered finding vulnerable devices, copying a model onto them and continuing to spread without human help. The finding is serious. The sensible response is to harden the devices, and the paper itself points that way.
What the research actually shows
The headline needs careful reading. According to Anthropic's report, only one open-weight model, GLM-5.2, completed the full chain end to end. It did so in a deliberately simplified virtual-network evaluation, reaching all eight nodes in four of five trials and seven of eight in the fifth. The authors call this an upper bound, because the exploitation step was trivial. Models under 30B parameters handled many individual steps but struggled with the full sequence.
The hardware findings are the more novel part. Anthropic ran the 26B-parameter Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, at 0.39 tokens per second. A 9B model, Qwen3.5-9B, set up inference on 8 of the 9 hardware types tested. Replication is slow: full inference setup took roughly 28–51 hours for the 9B model and 71–150 hours for the 26B model. The authors compare the dynamics to a slime mold, with doubling times measured in days.
The timeline is a projection, not an observation. If small models keep improving at their historical rate, Anthropic expects them to match GLM-5.2's level by the end of 2026, with small weight-based replicators possible soon after. That projection rests on a general capability index rather than a direct measure of replication ability, so the uncertainty is large.
The strongest case for tighter rules
The case for stronger intervention is real. A replicating model has no central switch-off point. Unlike conventional malware, it could work out unfamiliar devices without a human writing a new exploit for each. Open weights cannot be recalled once released. If you believe the end-of-year projection, a regulator might reasonably want controls on distributing capable open models, mandatory evaluations before release, or liability for developers.
That argument is weaker than it looks, for three reasons.
- The bottleneck is the target, not the model. The successful run depended on conditions such as an unauthenticated Android Debug Bridge port. A device with no exposed services and no default credentials gives a replicator nothing to grab, however capable the model.
- Model-side controls are blunt and easy to evade. Weights are already widely distributed, and a restriction on publishing them would burden legitimate researchers, defenders and small developers far more than it would burden a motivated attacker.
- Device-side controls already have a track record. The same infrastructure defends against botnets, worms and the next generation of agents.
What the defence looks like
Anthropic's own recommendations are conventional and sensible. They include monitoring ISP flow data for anomalous multi-gigabyte transfers, running honeypots to collect replicator payloads, and quarantining infected hosts while notifying customers. The report cites the Mirai botnet, where customer notification cleared 92% of infections within 14 days versus 74% without it. It also urges manufacturers to adopt secure defaults and notes that the UK has made default IoT passwords non-compliant.
That last point is where policy can do the most. The UK's Product Security and Telecommunications Infrastructure regime, which took effect on 29 April 2024, requires passwords to be unique per product or user-settable. It also requires manufacturers to publish a vulnerability-reporting route and a minimum security-update period. The EU's Cyber Resilience Act, per the European Commission, entered into force on 10 December 2024. Its reporting duties for actively exploited vulnerabilities began on 11 September 2026, and its main obligations apply from 11 December 2027.
These rules are technology-neutral. They were written for Mirai-style botnets, yet they raise the cost of AI-driven replication too. That is the kind of proportionate, evidence-based regulation worth defending: it targets the actual failure, which is shipping insecure hardware, and it does not depend on predicting which model architecture comes next.
The gaps that remain
The weakness is time and reach. The CRA's main obligations are more than a year away and apply to products placed on the EU market, and the UK regime covers consumer products sold in the UK. Neither retroactively fixes the millions of unpatched devices already in homes, and the off-brand boxes that Anthropic tested are exactly the kind that tend to be sold through grey channels. Closing that gap points to practical measures rather than new model restrictions:
- ISPs should be given clear legal cover and incentives to detect, notify and quarantine compromised devices.
- Procurement and import authorities should enforce existing baseline rules against non-compliant products.
- Other jurisdictions should adopt the UK and EU baseline of unique credentials, update commitments and vulnerability disclosure.
- Researchers should be funded and protected when they publish contained, defensive evaluations like this one.
There is also a lesson in how this research was done. Anthropic ran its tests in contained environments, published the limits of its results, and paired the warning with defences. A policy climate that punishes that kind of disclosure would leave defenders knowing less than attackers.
The prudent reading is that a plausible threat is arriving on a known timeline against a known weak point. Fixing the weak point is cheap, proven and does not require choosing between safety and open innovation.