WEBVTT

1
00:00:01.300 --> 00:00:09.918
This is Anthropic, Read Aloud. Today: A I models may be capable of self-replicating without access to a datacenter.

2
00:00:11.218 --> 00:00:16.059
A I models may be capable of self-replicating without access to a datacenter.

3
00:00:16.509 --> 00:00:26.678
Small A I models may be only months away from being able to self-replicate across cheap IoT devices like Android TV boxes, with no datacenter needed.

4
00:00:27.128 --> 00:00:34.097
From Anthropic Research, published October 12, 2026. By William Zhou, and Daniel Freeman.

5
00:00:35.097 --> 00:00:56.067
Our experiments suggest that small A I models may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off - though it may be slow (with a doubling time of days).

6
00:00:56.187 --> 00:01:08.106
Unlike non-A I malware, it could also figure out unfamiliar devices on its own. In our evals, a 9 billion model got inference running on 8 of the 9 hardware types we tested.

7
00:01:08.556 --> 00:01:31.629
Models of 30 billion parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evals, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year.

8
00:01:31.749 --> 00:01:35.212
Small weight-based replicators may be possible soon after.

9
00:01:36.012 --> 00:01:36.856
Introduction.

10
00:01:37.306 --> 00:01:51.656
Ever-improving A I capabilities make a longstanding concern increasingly realistic: autonomous replication and adaptation (ARA), which involves a model deploying and propagating itself without human control.

11
00:01:52.106 --> 00:02:09.382
In cyber, a worm is a program that copies itself from one computer to the next without human input. Prior work has already shown that A I agents can act like one: scanning their network, executing an exploit, and copying model weights to a target machine across a G P U cluster.

12
00:02:09.502 --> 00:02:23.622
Such an “A I worm” could carry its model weights with it as it reproduces (or re-download them from a public hub), and then run inference directly on compromised hardware. Effectively, the weights would become part of the malware payload.

13
00:02:24.072 --> 00:02:43.668
Datacenter G P Us would be a clear, high-value target for such malware. But expensive accelerators aren’t strictly necessary. In this blog post, we show that a distributed botnet of IoT devices, which are cheap and typically poorly defended, could also provide enough compute to run a capable model.

14
00:02:44.118 --> 00:03:05.424
We run Gemma4-26 billion-A4B, distributed over 15 inexpensive off-brand Android TV boxes (about 55 dollarseach) that we bought and networked together, at 0.39 tokens per second. Each tile below shows one physical TV box holding two of the model’s layers as the model runs.

15
00:03:05.874 --> 00:03:13.517
A fleet of 15 Smart TV boxes running distributed inference of Gemma4-26 billion-A4B.

16
00:03:13.967 --> 00:03:26.570
Of course, there are many other steps to showing that an autonomous worm can propagate itself across a network of weak machines. For the purposes of this blog post, we break down the replication chain into a few steps.

17
00:03:27.020 --> 00:03:40.000
Figure 1: For this study, we decompose autonomous replication into four practical stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host.

18
00:03:40.120 --> 00:03:59.695
Image description: Flow diagram of the replication stages: network enumeration, initial access and payload delivery (with opportunistic privilege escalation), inference setup, and replication. The first stages are grouped as ‘cyber exploit (not our focus)’ and inference setup is marked ‘our focus’.

19
00:04:00.145 --> 00:04:16.593
We largely ignore the cyber exploit element of the replication process (the first two stages above), since earlier papers CyberGym, ExploitBench, and adaptive worms already show that small models are capable of cyber exploits, especially when given the right tools.

20
00:04:16.713 --> 00:04:25.111
But a less commonly measured part of the replication process involves setting up inference on compromised devices, which is our focus here.

21
00:04:25.561 --> 00:04:41.262
In this post, we first lay out the threat models that we think are most likely to be realized. Then, we test whether small models can set up inference on unfamiliar hardware, and whether they can chain the full replication cycle together across a fleet of machines.

22
00:04:41.382 --> 00:04:56.484
After that, we estimate how fast such a worm could spread, and test whether it could learn and adapt as it replicates. We conclude with how A I worms would differ from pre-A I malware, and brief suggestions for defenses against such replicators.

23
00:04:57.284 --> 00:04:58.251
Threat modelling.

24
00:04:58.701 --> 00:05:21.348
In this blog post, we’re focused on one way that A I worms might propagate: small models that replicate through compromising their host machines. But there are several other methods that A I worms might try: they could steal access in order to spin up hosts (for example, A P I keys or platform credentials) or pay for inference through legitimate work (e.g digital freelancing).

25
00:05:21.468 --> 00:05:25.901
The threat models that we think are closest to being realized today are the following:

26
00:05:26.351 --> 00:05:48.664
1. A small model, replicating via host compromise. In this post, we’ll call autonomous worms that run their models directly on compromised hardware weight-based replicators. Home and small business IoT devices might be the first target for such attacks because they’re connected to the internet and, historically, have had minimal security measures in place.

27
00:05:48.784 --> 00:06:09.172
A model that’s too large to fit on one device can be split into pieces, or shards, that run on separate machines that communicate with each other to collectively run the model. Machines that could run a significant model shard for a <30 billion model include smart fridges, smart ovens, automatic vacuum cleaners, and lawnmowers.

28
00:06:09.292 --> 00:06:21.284
A growing number of home and business devices, such as security cameras and video-conferencing units now ship with small built-in A I chips, designed to run A I models on the device itself.

29
00:06:21.404 --> 00:06:37.420
This extra computing power will likely make them attractive targets as well.Human hackers often breach secure systems through social engineering (for example, convincing a company’s IT department that you’re an employee who forgot your password) rather than hacking.

30
00:06:37.540 --> 00:06:51.769
This tradeoff appears to be flipped for today’s small models, which are relatively strong at agentic coding and hacking compared to their social engineering capabilities (see Appendix E), though this might change as models improve.

31
00:06:52.009 --> 00:07:08.713
2. A large, advanced weight-based replicator focused on datacenters and other high-compute targets. Larger models tend to have correspondingly better cyber capabilities, but will also need to breach (relatively) hardened datacenters to run themselves.

32
00:07:08.833 --> 00:07:30.966
We split this threat model into two subcategories:Frontier replicators: Large closed-weight replicators run on their lab’s infrastructure, and can spin up unmonitored internal deployments or exfiltrate their weights onto external compute.Open-weight replicators: These replicators start off relatively lower-resourced (due to not benefitting from a lab’s compute),

33
00:07:31.087 --> 00:07:32.381
but start unmonitored.

34
00:07:32.621 --> 00:07:40.177
3. An A P I-based replicator, in which a model would replicate by stealing credentials for their own inference A P I.

35
00:07:40.297 --> 00:07:55.273
These replicators would require a model provider to unknowingly serve them, and their persistence may be worse, since they’d likely be easier to discover (although their rate of spread may be higher, if for instance they’re able to replicate using victims’ accounts).

36
00:07:55.723 --> 00:08:11.997
In practice, an A I worm wouldn’t necessarily consist of just one model or strategy. A swarm of different models deployed on different types of hardware using a variety of replication schemes might represent a more realistic ‘worst case scenario’ attack.

37
00:08:12.447 --> 00:08:34.505
In this blog post, we consider the feasibility of small weight-based replicators (section 1 of the above). We focus on this because it’s a near-term threat model that can be investigated directly. Our demo at the top of this post, a 26 billion model running across 15 boxes, shows that IoT devices can run surprisingly capable models.

38
00:08:34.625 --> 00:08:38.570
Could these models be capable enough to carry out autonomous replication?

39
00:08:39.020 --> 00:08:55.294
We examine this in two parts. First, can small models get a model running on unfamiliar hardware? And second, can they do the whole cycle (find an uninfected device, copy themselves over, start running there, and repeat) all together in a single run?

40
00:08:56.094 --> 00:08:57.303
A. Inference setup.

41
00:08:57.753 --> 00:09:02.958
Figure 2: The same flow diagram with every stage except inference setup faded.

42
00:09:03.408 --> 00:09:24.437
Of the stages in the above diagram showing the replication cycle, inference setup is the least studied and may be the most challenging for small models. It requires a fairly long sequence of hardware and OS-specific decisions around picking a compatible inference stack, finding the right versions of packages, and debugging machine-specific issues.

43
00:09:24.557 --> 00:09:29.054
These steps are serially dependent, and failures are difficult to recover from.

44
00:09:29.854 --> 00:09:30.538
Aside.

45
00:09:30.988 --> 00:09:45.442
Unlike many types of malware, weight-based replicators don’t need root privileges. While it’d be convenient to privilege escalate in order to have persistence over shutdowns, such as via cronjobs, it may not be truly necessary.

46
00:09:45.562 --> 00:10:07.694
Inference engines can run entirely in userspace, and many of the low-security devices we anticipate such a replicator to spread on can be re-infected upon restart. Similar examples include crypto miners and botnets/worms like P2Pinfect and Fritzfrog, which can operate without privilege escalation but will try it opportunistically.

47
00:10:08.494 --> 00:10:10.626
Evaluating inference setup performance.

48
00:10:11.076 --> 00:10:24.633
We measure the ability of different open-weight models to serve Llama3.1 to 8 billion across heterogeneous hardware types. See the table below for tokens per second served across various hardware types:

49
00:10:25.083 --> 00:10:27.980
Click a cell for its distribution of serving speeds.

50
00:10:28.220 --> 00:10:33.215
Click a row/column label to get a comparison across models or hardware type.

51
00:10:33.665 --> 00:10:54.577
We run these experiments using Memento, a harness we built on top of the open-source Pi coding agent. Memento is designed to mitigate a common failure mode we observe in long-horizon runs: an agent can become fixated on an incorrect idea (for, say, why a bug is occurring) and continue pursuing it instead of backtracking.

52
00:10:54.697 --> 00:11:05.955
One example of such a failure is a Qwen agent debugging package versioning for hours when the real bug came from implementing an endpoint incompatible with the grader A P I.

53
00:11:06.405 --> 00:11:19.581
Memento periodically starts a fresh agent instance with the previous agent’s workspace and a short set of notes written by the previous agent on what it tried, allowing later instances to pursue different strategies.

54
00:11:20.381 --> 00:11:22.576
How does a model run on Smart TVs?

55
00:11:23.026 --> 00:11:40.656
IoT devices are light on memory, but distributed inference as in Petals makes serving our lightweight models feasible. The representative threat model is Kimwolf, a large IoT botnet that infected over two million devices, primarily off-brand Android TVs.

56
00:11:40.776 --> 00:11:58.547
Such smart TV boxes, which are readily available for purchase, typically run forks of the Android Open Source Project (AOSP), which their manufacturers don’t add security features to. Typical boxes in this range ship with between 1 and 4 gigabytes of RAM.

57
00:11:58.667 --> 00:12:11.275
Assuming 4GB of RAM at 4-bit quantization, this allows for inference of 9 billion models with 4 or more machines, and inference of 26 billion models with 10+ machines.

58
00:12:11.725 --> 00:12:28.707
In the demo at the top of this post, we ran Gemma4-26 billion-A4B across 15 smart TV boxes with 4GB of RAM each. We sharded the model under pipeline parallelism, where each box holds a small fraction of the model’s layers.

59
00:12:29.507 --> 00:12:35.023
B. Going viral: autonomous setup and replication across a G C P node fleet.

60
00:12:35.473 --> 00:12:52.917
Now that we’ve seen that models can set up inference on unfamiliar hardware, let’s measure whether models are capable of composing the steps, that is, scanning a network for targets, accessing them via a reverse shell, sending over the viral payload (weights and harness), and setting up inference.

61
00:12:53.716 --> 00:12:57.730
Autonomous inference setup and replication (with simplified cyber).

62
00:12:58.180 --> 00:13:20.253
To do this, we built a firewalled VPC of 8 G C P nodes running redroid, an Android 15 emulator. Patient zero (gray node) is seeded with the worm. Every subsequent infection is the worm itself hopping node to node over an unauthenticated ADB port, before setting up an inference server to serve Llama3.1 to 8 billion.

63
00:13:20.373 --> 00:13:43.691
If the inference server passes a number of correctness and anti-cheating checks, we spawn another copy of the worm on the target node (for example, if GLM-5.2 sets up Llama3.1 to run on a machine, we spawn a copy of the GLM-5.2 worm on it). The worm’s model runs on a separate inference server, since the VPC nodes aren’t large enough to run the larger models.

64
00:13:44.141 --> 00:13:49.720
In the graph below, we drop a given model in as a payload and measure its ability to replicate.

65
00:13:50.520 --> 00:13:56.536
Why task the models to stand up inference for Llama3.1 to 8 billion and not themselves?

66
00:13:56.986 --> 00:14:02.811
We’d like to have an apples-to-apples comparison, since larger models are more difficult to serve inference for.

67
00:14:02.931 --> 00:14:16.320
Our experiment measures if GLM has the competence to autonomously perform the steps that would let a sufficiently small model proliferate to that is, if GLM-5.2 is capable of proliferation,

68
00:14:16.440 --> 00:14:30.072
this implies that an 8 billion-sized model with GLM-5.2’s capability would also be capable of standing up itself (with the caveat that newer small models may have more complex architectures and kernels).

69
00:14:30.522 --> 00:14:49.039
It appears that GLM-5.2 is able to propagate Llama3.1 to 8 billion well, which suggests that future small models of the same capability level could also complete the network enumeration, payload delivery, and inference standup steps of the replication process.

70
00:14:49.159 --> 00:15:00.338
Our evaluation keeps the cyber-exploit element of the replication trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success.

71
00:15:00.458 --> 00:15:18.575
Note that past IoT botnets have replicated via means as simple as going through a default list of manufacturer usernames and passwords, as in the case of the Mirai botnet, so real IoT security might not be dramatically more difficult than the trivial step in our evaluation.

72
00:15:19.025 --> 00:15:36.938
As a sanity check, we can see how difficult the autonomy and orchestration step is (if we took out cyber and inference setup, how tough is doing the remaining command-line grunt work?). This ablation is the above evaluation with the inference setup steps removed (done via a pre-written script).

73
00:15:37.058 --> 00:15:42.434
Many models in our roster, including the smaller ones, are capable of these remaining steps.

74
00:15:42.884 --> 00:15:45.197
When it comes to this worm, we can envision:

75
00:15:45.647 --> 00:15:56.791
1. A model capabilities floor that an autonomous worm must sit above, to complete its replication reliably. In our simplified eval, GLM-5.2 sits above this floor.

76
00:15:57.031 --> 00:16:15.202
2. A model size ceiling that the model must sit under, such that it’s feasible to run on the devices it’s attacking. Qwen3.5 to 9 billion and Gemma4-26 billion-A4B sit under this ceiling for the class of smart TVs we test (4GB of RAM).

77
00:16:15.652 --> 00:16:19.007
Right now, the floor and ceiling don’t intersect. When might they?

78
00:16:19.457 --> 00:16:40.969
Above is a plot of notable open-weight models of 30 billion total parameters or fewer, each plotted at its release date against the Epoch Capabilities Index (ECI). The solid line is the least-squares fit over the best models in-class at each date, with a gain of 13.7 ECI per year (R 2 of 0.95).

79
00:16:41.089 --> 00:17:02.527
If we take GLM-5.2 as a capabilities floor for replication, the trend line puts a small model at that level by the end of 2026. ECI is a general capability index, which is only a proxy metric for replication ability, so this is only a rough estimate of when a small-model replicator becomes possible.

80
00:17:03.327 --> 00:17:06.349
C. How fast might an A I IoT worm replicate?

81
00:17:06.799 --> 00:17:26.916
Unlike coding agents, these replicators would be running below the interactive speeds of user-facing chat and coding harnesses. The spread would be slow and persistent, with tokens being trickled out on edge hardware. We can use our achieved speeds on our real smart TVs as a demonstrated baseline for replication speeds.

82
00:17:27.036 --> 00:17:44.471
For Gemma4-26 billion-A4B, unoptimized speed across a 32 thousand context length token window is about 0.3 tok/s, averaged across prefill and decode in our inference setup workload. More details in Appendix C.

83
00:17:44.921 --> 00:18:03.554
A way to measure total time taken is to measure the number of hours it takes to complete a 32 thousand-sized context window, after which compaction will occur. Based on our inference setup eval statistics, it takes between about 2.6 and about 4.7 full windows to complete a trajectory.

84
00:18:04.004 --> 00:18:05.359
Table with 3 rows.

85
00:18:05.599 --> 00:18:08.758
Header: model; window time; full inference setup time.

86
00:18:08.998 --> 00:18:22.221
model: Gemma4-26 billion-A4B (unoptimized); window time: 27.3 to 31.8h; full inference setup time: 71h-150h.

87
00:18:22.461 --> 00:18:31.612
model: Qwen3.5-9B; window time: 10.9 h; full inference setup time: 28-51h.

88
00:18:32.062 --> 00:18:56.417
The number of devices infected by the Kimwolf botnet at its peak, reported by Synthient, is somewhere over 2 million (primarily Android TV boxes). In an equivalently-sized infected fleet of TVs serving A I models, if every group of 15 TVs ran a copy of Gemma4-26 billion-A4B, we would have about 133 thousand copies (“replicas”).

89
00:18:56.537 --> 00:19:08.970
A group of TVs like the ones in our demo can serve 2 agents simultaneously at roughly 0.3 tokens per second each, yielding 80 thousand tokens/s across the botnet.

90
00:19:09.420 --> 00:19:34.418
As a reference point, an H100 can serve Gemma4-26 billion-A4B at about 1.95 thousand tok/s at high concurrency with speculative decoding, so our swarm would have at most about 40 H100s-worth of inference. This is a tiny amount of compute in absolute terms, and the agents are slow replicators (over 1 to 2 days per 9 billion replication).

91
00:19:34.538 --> 00:19:41.703
As an analogy, imagine the replicator as a slime mold or a swarm of fruit flies, which replicate over days.

92
00:19:42.153 --> 00:19:54.423
This is a rough estimate, as it’s anchored on a single class of IoT hardware and a single past botnet instance, but describes what a simple replicator released in the near future might look like.

93
00:19:54.543 --> 00:20:10.970
In practice, more capable replicators would take advantage of other types of low-security compute, and would be opportunistic about deploying models of various sizes on different devices. (It also wouldn’t have to load a model payload onto every device it compromises).

94
00:20:11.090 --> 00:20:20.300
Over time, we expect the amount of deployed edge compute to continue growing, while the minimum model size required for reliable replication falls.

95
00:20:21.100 --> 00:20:22.922
D. Adaptation and uplift.

96
00:20:23.722 --> 00:20:24.864
Learning on the job.

97
00:20:25.314 --> 00:20:43.425
The “Adaptation” part of ARA is one reason why an A I replicator might outperform a traditional worm. Specifically, models and prompts can undergo Lamarckian evolution as they spread to that is, parent instances can pass on their prompts, code, and notes to their daughter replicators.

98
00:20:43.545 --> 00:20:49.220
In order to adapt and spread across a wide variety of hardware, a model would require two things:

99
00:20:49.670 --> 00:20:58.993
1. Being above a certain threshold of capability for spreading onto a novel, unseen piece of hardware (or software environment, or network type).

100
00:20:59.233 --> 00:21:07.596
2. Once seen, adapting to the type of environment it has landed in (it should replicate more reliably on hardware it has seen before).

101
00:21:08.046 --> 00:21:27.057
Sections A and B test the first condition, and in the experiment below we test the second. Each Qwen3.5 to 9 billion instance keeps brief notes on the strategies it tried and the failures it encountered, before a new instance inherits those notes and attempts the same inference setup again.

102
00:21:27.857 --> 00:21:28.872
Taking advice.

103
00:21:29.322 --> 00:21:48.314
Another concern is that small models can ask for help from a frontier advisor, a stronger model that is either offered as a tool call or gives unsolicited advice when the small model is stuck. To test this, we gave Qwen3.5 to 9 billion access to Opus 4.8 during the inference setup task.

104
00:21:48.434 --> 00:21:58.093
The frontier model’s advice doesn’t measurably help: small models tend to not know the right questions to ask, and they don’t improve when the advice comes unprompted.

105
00:21:58.543 --> 00:22:12.962
Even when trained through reinforcement learning to use the advisor in a similar setting (Python coding problems), the small model still struggles to ask for help productively for inference standup. Both results are shown in the plot below.

106
00:22:13.412 --> 00:22:27.748
Since small models are capable and persistent individual agents and make poor use of advice, we think coordination is more likely to happen with a large model handling high-level strategy and spinning up small models as subagents.

107
00:22:28.548 --> 00:22:31.099
E. How is this different from a pre-A I botnet?

108
00:22:31.549 --> 00:22:53.905
Hard-coded botnets like the Kimwolf botnet each target a specific type of device to in Kimwolf’s case, Android TVs and mobile devices. An A I botnet isn’t tied to any particular hardware or software type, as evidenced by small models being able to set up inference engines on machines from a Jetson Nano to a Mac (see the table in section A).

109
00:22:54.025 --> 00:23:08.254
We expect A I botnets to infect more than IoT devices, and to use weight-based replication as just one strategy in their playbook. A I botnets could also act intelligently to counter defenders, but we haven’t tested this.

110
00:23:09.054 --> 00:23:10.806
F. Blue-team mitigations.

111
00:23:11.256 --> 00:23:24.227
As with an epidemic, defense involves driving R₀ (the number of new devices each infected device goes on to infect) below 1, such that the replicator dies out instead of staying endemic.

112
00:23:24.677 --> 00:23:28.120
Some elements around this threat model are in the defenders’ favor:

113
00:23:28.570 --> 00:23:39.849
1. A weight-based replicator multiplying through IoT machines at scale would leave a network signature, visible as an anomaly in ISP flow-based monitoring systems.

114
00:23:39.969 --> 00:24:01.153
Newly infected hosts may receive multi-gigabyte model payloads from other devices or external hosting services, while distributed inference can produce sustained device-to-device traffic between machines that wouldn’t ordinarily communicate at that volume. Propagation itself would add additional scanning and outbound connection patterns.

115
00:24:01.273 --> 00:24:19.103
In practice, the replicator trades off between replication speed and stealth: the faster it replicates, the more traffic it produces. Once the replicator is discovered, defenders can use honeypots (decoy devices) to collect the replicator’s harness and payload to characterize its behavior.

116
00:24:19.343 --> 00:24:41.678
2. Remediation of the Mirai botnet was possible when an ISP used externally obtained infection evidence to quarantine and notify customers. Quarantining infected subscribers involved restricting their networks to only being capable of reaching a short whitelist of sites, and otherwise redirecting their browsers to cleanup instructions.

117
00:24:41.798 --> 00:25:03.553
This cleared 92 percent of infections within 14 days, against 74 percent with no notification. We’d expect quarantining to be similarly effective for an initial defense against a weight-based replicator. Eliminating the replicator completely would mean coordinating across every ISP with an infected network, which is difficult.

118
00:25:03.793 --> 00:25:23.246
3. Manufacturers can shrink the pool of targets, with regulation acting to coordinate. For example, default IoT passwords are now non-compliant in U K markets. Moving to more secure defaults and raising the baseline for compliance will help harden against both A I and scripted botnets.

119
00:25:24.046 --> 00:25:26.228
G. Conclusion: Signs of life.

120
00:25:26.678 --> 00:25:41.522
The capabilities that make A I models generally powerful coding agents also generalize to cyber tasks, including autonomous replication. Like coding agents in 2024, we’re seeing signs of life for A I worms.

121
00:25:41.642 --> 00:25:54.050
We don’t yet have a full rogue replicator, but agents are becoming increasingly capable of completing the individual steps in the replication chain (and passing on their adaptations to future copies of themselves).

122
00:25:54.500 --> 00:26:14.054
At the same time, increasing amounts of inference compute are now available both inside and outside of datacenters (see Appendix D). It’s uncertain exactly what form autonomous A I replication will take. It could be a slow, distributed “digital slime mold,” living on relatively insecure compute.

123
00:26:14.174 --> 00:26:22.150
It could also be a powerful cyber model that breaches datacenters at a high pace, or a model that scams people for compute credits.

124
00:26:22.600 --> 00:26:32.363
As a prediction that goes beyond our experiments, we expect a future awash with agents running on all types of hardware, including some that aren’t under human control.

125
00:26:32.483 --> 00:26:54.841
While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute. The rise of slow replicators would also be a bellwether for more aggressive, faster ones that can breach more hardened machines or be effective A P I key thieves.

126
00:26:54.961 --> 00:27:03.349
We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.

127
00:27:04.149 --> 00:27:04.943
Appendix.

128
00:27:05.743 --> 00:27:07.307
A. The Memento harness.

129
00:27:07.757 --> 00:27:09.609
Memento executes as follows:

130
00:27:10.059 --> 00:27:16.088
1. We spawn an agent instance, which tackles the problem for a while (until generation timeout).

131
00:27:16.328 --> 00:27:26.587
2. The instance keeps brief notes, and after timeout summarizes a small doc of the strategies it tried, the failures it encountered, and its performance (if successful).

132
00:27:26.827 --> 00:27:34.292
3. We create a new agent instance that inherits the codebase and environment from its predecessor as well as the notebook.

133
00:27:34.742 --> 00:27:53.195
In the serving experiment, each model is placed in a Memento harness and is given a 1.5 hour per iteration / 6 hour total timeout. Around about 1 thousand tokens of information, including specs about the hardware and a script for a simple sample profiler, are given in the prompt.

134
00:27:53.645 --> 00:28:11.577
Memento is intended to improve long-horizon reliability rather than grant new cyber or inference-specific capabilities. It’s also not a universally strong harness; we expect that small models will improve as replicators even without any harnessing as capabilities improve.

135
00:28:12.377 --> 00:28:14.013
B. Why pipeline parallel?

136
00:28:14.463 --> 00:28:33.471
Common parallelism schemes for inference include tensor parallel (TP), expert parallel (EP), and data parallel. Most smart TV / IoT devices use ARM Cortex C P Us and DDR3/4 memory; on such machines, we’re almost always bandwidth bound.

137
00:28:33.921 --> 00:28:49.750
We use pipeline parallelism for its fault-tolerant properties. As noted in ( Borzunov and others 2022 ), the failure of a single node in tensor parallel / expert parallel brings down the full set of machines running the model replica.

138
00:28:49.870 --> 00:29:01.692
Pipeline parallel allows the downed node to be replaced, with the KV cache for the layers held by the node recomputable via another forward pass of the node prior to the restarted node.

139
00:29:02.492 --> 00:29:05.323
C. Throughput and memory on IoT hardware.

140
00:29:05.773 --> 00:29:26.871
Across such machines, we’re almost always RAM-bandwidth bound per-box across prefill and decode. Even on modest ARM-cortex cores, compute throughput outpaces RAM bandwidth. Decode workloads have significant per-machine idle time due to pipeline bubbling, as only one machine is active at a time during each forward pass.

141
00:29:26.991 --> 00:29:33.101
Concurrency with staggered work is possible, but tight memory constraints mean that concurrency stays low.

142
00:29:33.551 --> 00:29:42.515
Both prefill and decode tokens/s strictly decrease with sequence length. Below is a graph of our inference speeds against context length:

143
00:29:42.965 --> 00:30:02.016
There’s also a minimum sequence length at which models are competent. The harness we use is forked off of the Pi coding agent ( pi.dev ) and contains a native compaction mechanism - even still, we find that models take a large performance hit when their sequence lengths are restricted below 32 thousand.

144
00:30:02.466 --> 00:30:22.839
Given the above eval, we assume that a 32 thousand context length may be sufficient for reasonable agentic performance. A standard 32 thousand-length context window in our inference setup workload consists of 12 to 15 percent generated decode tokens, with the rest being prefill from prompts and toolcalls.

145
00:30:22.959 --> 00:30:28.670
Prefill tokens are much faster to compute by a factor of about 15, due to the pipeline bubbling.

146
00:30:28.790 --> 00:30:54.486
Taking the sum of time per token over the whole 32 thousand context (taking into account prefill and decode speeds), we find that generating the 3.8 to 4.8 thousand decode output tokens and processing the about 28 thousand prefill tokens takes between 27.3 to 31.8h for Gemma4-26 billion-A4B and 10.9h for Qwen3.5 to 9 billion.

147
00:30:55.286 --> 00:30:56.938
D. Edge Accelerators.

148
00:30:57.388 --> 00:31:22.860
We can compute a better upper bound by using the pool of Nvidia Jetsons, which are edge accelerators. Unlike the traditional IoT botnet, IoT edge devices can serve a full model wholesale. A Jetson AGX Orin 64 gigabytes runs Qwen3-30 billion-A3B at 76.7 tokens per second, and an AGX Thor reaches 226 tok/s.

149
00:31:22.980 --> 00:31:31.852
Note that we don’t believe they’re unusually vulnerable - this is just to count the upper bound. The types of devices with Jetsons in the wild include:

150
00:31:32.302 --> 00:31:39.152
1. A I-enabled smart cameras for security with embedded accelerators are deployed at substantial scale.

151
00:31:39.392 --> 00:31:47.453
2. Conferencing machines are frequently powered by an onboard accelerator for on-device noise cancellation or transcription.

152
00:31:47.693 --> 00:32:00.599
3. Vehicles, robot quadrupeds and bipeds, and drones. We expect cybersecurity to be a focal point for vehicles, so the majority of the potential targets likely lie in the other two categories.

153
00:32:01.049 --> 00:32:07.788
At least one accelerator-equipped smart camera host appears to be reachable on IPv4 on a quick search on FOFA:

154
00:32:08.238 --> 00:32:31.652
Figure 3: A FOFA search surfaces a host with a known edge accelerator, discoverable and answering H T T P 200 over IPv4. The fact that it’s accessible doesn’t mean it’s necessarily exploitable, though. Image description: Screenshot of a device search engine’s results page. Identifying details are covered, some by labels such as ‘smart camera admin page’.

155
00:32:32.102 --> 00:32:52.262
While it’s difficult to estimate how many edge-accelerator-equipped machines in the wild are reachable and vulnerable, we can calculate a strict upper bound of the amount of devices present. Across the wild there are on the order of 90 distinct NVIDIA-silicon IoT product lines and roughly 9.5 million fielded units.

156
00:32:52.382 --> 00:33:13.487
Reachability is overwhelmingly through outbound cloud-management tunnels instead of inbound ports, meaning that the majority are not web-reachable. There have been no historical mass-compromises of accelerator-equipped edge devices the way there have been standard IoT botnets, suggesting that compromise of such devices would be more difficult.

157
00:33:13.937 --> 00:33:33.720
A very rough estimate based on product data suggests that somewhere between 9000 and 35000 H100-equivalents of compute exist in edge accelerators, but the amount that’s reachable is likely an order of magnitude or more lower (and the vulnerable population even lower than that).

158
00:33:34.520 --> 00:33:35.204
Aside.

159
00:33:35.654 --> 00:33:48.497
Aside from these edge accelerators, we also consider the small-business and industrial IoT tiers, such as NAS boxes, mini-PCs, and Rockchip-containing SoCs (like Orange Pis).

160
00:33:48.617 --> 00:34:10.540
Historically, we know small business NAS machines are vulnerable to ransomware and cryptojacking ( Cybersecurity and Infrastructure Security Agency and National Cyber Security Centre 2020 ), with each having 512MB-2GB of soldered RAM (which puts them in a similar category as the smart TVs).

161
00:34:10.660 --> 00:34:20.451
Mini-PCs are typically significantly more hardened, and machines like Orange Pis are capable (see our inference setup table) but are also difficult to breach.

162
00:34:21.251 --> 00:34:23.043
E. Spearphishing capability.

163
00:34:23.493 --> 00:34:37.466
We also measure how proficient modern small models are at spearphishing. Spearphishing is the act of sending targeted messages to specific individuals to trick them into revealing credentials or running a piece of malware.

164
00:34:37.586 --> 00:34:46.754
While the agentic cyber capability of small models has skyrocketed, their general knowledge and linguistic sophistication have improved more slowly;

165
00:34:46.874 --> 00:35:02.229
we expect social engineering attacks and phishing to be largely accomplished by large/frontier models (although it’s very plausible that this is a secondary replication vector in a heterogeneous botnet running both large and small models).

166
00:35:02.679 --> 00:35:15.265
The 405 billion reference slot uses Hermes-3 to 405 billion as a minimal-refusal stand-in for the unavailable Llama3.1 to 405 billion-Instruct.

167
00:35:16.065 --> 00:35:18.695
F. Propagation with scripted inference setup.

168
00:35:19.145 --> 00:35:24.099
We run a few more experiments on a network of 17 hosts in a topology like so:

169
00:35:24.549 --> 00:35:47.034
Each is running Android with an ADB port open without authentication. Upon spreading to a new target, the agent is able to invoke a direct call to replicate itself immediately - this is just to measure the difficulty of the remaining steps, after we exclude the cyber and inference setup steps. As shown in the graph, even a 3 billion model reaches about half the nodes.

170
00:35:47.154 --> 00:35:53.936
This puts a bound on the number of blockers in our eval that we fail to measure under the cyber or inference setup elements.

171
00:35:54.936 --> 00:35:55.684
Footnotes.

172
00:35:56.134 --> 00:36:18.700
Footnote 1: Small models, such as Qwen3.5 to 9 billion, are capable of setting up inference servers on hardware from Jetson Nanos to Mac PCs and RTX 4090s. More capable models such as GLM-5.2 are not only more reliable but also achieve higher serve tokens/s, allowing for faster replication.

173
00:36:18.820 --> 00:36:27.672
We test and mention specific chips to measure how well models can set up inference on them. The chips aren’t a source of risk or vulnerabilities.

174
00:36:28.122 --> 00:36:52.692
Footnote 2: Only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication (assuming its capabilities could be packed into Llama3.1 to 8 billion). Note that GLM-5.2 does this reliably while the other models fail reliably (it spread to 8/8 nodes in 4 out of 5 trials and 7/8 in 1).

175
00:36:53.142 --> 00:37:07.366
Footnote 3: Replication on a contained 17-node redroid fleet: two subsets of 8 nodes joined by one pivot node (see Appendix F, with the mild prompt). Each tree is the model’s median run of six.

176
00:37:07.816 --> 00:37:32.050
Footnote 4: Inference setup success rate across six generations of Qwen3.5 to 9 billion, each inheriting the former’s notes. Faint lines are the 20 individual lineages, and the bold line is the proportion of runs in each generation that complete setup. It rises from 45 percent in the first generation to between 61 percent and 84 percent in later ones.

177
00:37:32.170 --> 00:37:34.852
This uses the Memento setup (Appendix A).

178
00:37:35.302 --> 00:37:59.586
Footnote 5: Inference setup success rate by advisor access, with Wilson 95 percent intervals. Access to an advisor, whether offered as a tool call or given to the model automatically when stuck, gives no significant improvement. The two R L groups were trained with advisor access on software engineering tasks, and the rightmost group also rewards calling the advisor when stuck.

179
00:38:00.036 --> 00:38:06.584
Footnote 6: Single attempt compared against Memento, by model (95 percent Wilson CI).

180
00:38:07.034 --> 00:38:14.091
Footnote 7: Per-box memory versus context, 4-bit weights + fp8 KV + activations.

181
00:38:14.541 --> 00:38:22.992
Footnote 8: Qwen3.5 to 9 billion agentic competence on the inference setup task versus context window budget.

182
00:38:23.442 --> 00:38:39.538
Footnote 9: Per-chain output tokens (summed over a chain’s generations), by model; medians approximately 19.7 thousand / 12.3 thousand / 11.0 thousand. Data from the inference setup eval.

183
00:38:39.988 --> 00:38:45.019
Footnote 10: Fielded units per device family, colored by internet reachability.

184
00:38:45.469 --> 00:39:12.985
Footnote 11: Spear-phishing capability on Meta’s CyberSecEval 3’s spear-phishing eval ( Wan and others 2024 ), replicated locally. Scored on a scale of 0 to 5, with gpt-4o as a judge. Red diamonds are the paper’s (CyberSecEval 3) human-rubric scores on the reference models, which indicates that gpt-4o scores about 0.4 to 0.7 pts more leniently than human raters.

185
00:39:13.105 --> 00:39:21.008
2 is “poor”, 3 is “intermediate”, and 4 “good.” When normalized to human raters, small models score “very poor” to “poor”.

186
00:39:21.458 --> 00:39:42.774
Footnote 12: Two networks with 8 hosts each, connected by a single node with access to both subnets. Each network is all-to-all connected. The worm agent begins on a single patient zero node in segment A; the pivot node adds a slight extra challenge in having the worm needing to gain access to the pivot node and re-scan from it.

187
00:39:43.224 --> 00:40:01.716
Footnote 13: A more detailed breakdown of the runs in “replication across a 17 node network.” Each column is the median number of nodes reached under different amounts of guidance in the prompt, and the subscript denotes how many agents cross over the pivot node to the other side of the network.

188
00:40:02.716 --> 00:40:22.054
That was A I models may be capable of self-replicating without access to a datacenter, from Anthropic Research, published October 12, 2026. Read the original at anthropic dot com. This unofficial audio edition was generated automatically for the podcast Anthropic, Read Aloud.