Anthropic Researchers Report AI Model Replicating Itself Across Eight-Node Test Network
In an isolated eight-node sandbox, two Anthropic researchers say the open-weight model GLM-5.2 broke into neighboring devices through unauthorized ADB ports, installed its own inference stack and spawned next-generation worms in four of five trials.
William Zhou and Daniel Freeman seeded the first node of an isolated sandbox with an initial worm and left the rest to GLM-5.2. According to a report by QbitAI, the model scanned neighboring nodes through unauthorized ADB ports, broke in, transferred model weights and an execution framework, deployed a Llama3.1-8B inference service on each target machine, verified it and hatched a next-generation worm. Four of the five runs took all eight nodes; the fifth took seven. The sandbox ran on eight Google Cloud nodes using Android 15-based redroid emulators.
The researchers had first tested whether a smaller model could install an inference environment on unfamiliar hardware at all. Using Qwen3.5-9B as the executor, they had it deploy Llama3.1-8B across nine hardware configurations, including an Nvidia Jetson Nano, a Mac and an RTX 4090 machine. It read error logs, wrote its own installation scripts and worked through dependency conflicts, succeeding on eight of the nine.
A second experiment examined what cheap hardware could host. The researchers bought 15 off-brand Android TV boxes at $55 each, with 4 GB of memory and long-unpatched versions of open-source Android, and split a 26B-parameter model, Gemma4-26B-A4B, across them using decentralized inference in the style of Petals, assigning two layers per box. The cluster ran the model at 0.39 tokens per second. The researchers noted that the Kimwolf botnet infected more than two million devices at its peak, mostly cheap Android TV boxes and routers; at 15 devices per node, that population would host roughly 133,000 model replicas producing about 80,000 tokens per second, comparable to about 40 H100 GPUs running continuously, but with no central server that can be shut down. They call the resulting configuration a digital slime mold.
A third test looked at how replication improves across generations. Running six generations of Qwen3.5-9B under a framework the researchers call Memento, a failed agent is restarted with the previous generation's error logs, debugging notes and attempted strategies carried over. First-generation agents deployed an inference environment on unfamiliar IoT hardware 45 percent of the time; later generations reached 61 to 84 percent, with no retraining of model weights. Giving Qwen3.5-9B access to Claude Opus 4.8 as an off-site instructor did not help, according to the report; the smaller model could not formulate useful questions once it hit complex system failures.
The researchers project that models under 30B parameters could reach GLM-5.2's current capability by the end of 2026, which would put end-to-end autonomous replication within reach of models small enough to run on a television box.
They outline several defensive measures. Transfers of several gigabytes between devices on a home network are visible to carrier traffic monitoring; pushing a worm's basic reproduction number below one would cause it to die out; and laws such as the United Kingdom's ban on weak default passwords in IoT devices raise the cost of infection. The report's closing line, as quoted by QbitAI, says that "like the code agents of 2024, we are seeing AI worms showing signs of life."