Anthropic: GLM-5.2 already self-replicates across devices

The Anthropic study distinguishes itself from prior AI security research by focusing on the hardest link in the replication chain: setting up a working AI environment on unfamiliar hardware. Earlier studies had already shown that small models can handle network scanning and access attacks. The researchers deliberately left out the actual hacking step and instead tested whether a model could configure itself to run on a device it had never seen before.

The experimental setup used 15 off-the-shelf Android TV boxes, each costing about $55 and carrying 4 gigabytes of RAM, with the Gemma4-26B-A4B model distributed across the devices. The model ran slowly but worked. Only GLM-5.2 completed the full chain, while a 9-billion-parameter model managed to set up an AI environment running Llama3.1-8B on 8 out of 9 tested device types. The researchers also tested artificial evolution, where model instances pass notes about successful and failed strategies to successors, and for Qwen3.5-9B the success rate climbed from 45 percent in the first generation to as high as 84 percent in later ones.

Anthropic CEO Dario Amodei had already warned in an earlier post that such a swarm could within 6 to 12 months take over the entire internet with a persistent botnet, causing hundreds of billions of dollars in damage. The researchers compare the replicator to a 'digital slime mold,' noting that its decentralized nature would make it hard to shut down, with no central kill switch. They also note that similar, less severe incidents have happened across the industry, including at Anthropic itself.