Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.
Models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end. In our simplified evaluations, GLM-5.2 and stronger models are capable of end to end replication. If small models improve at their historical rate, they’ll match this capability level by the end of this year.
We run Gemma4-26B-A4B, distributed over 15 inexpensive off-brand Android TV boxes (~$55 each), at 0.39 tokens per second using pipeline parallelism.
We decompose autonomous replication into: finding targets, gaining execution, establishing inference, and continuing propagation. This post focuses on inference setup on unfamiliar hardware using the Memento agent harness built on the Pi coding agent.
Small models such as Qwen3.5-9B can set up Llama3.1-8B inference servers across heterogeneous hardware. In a firewalled GCP redroid fleet with simplified cyber (unauthenticated ADB), only GLM-5.2 reliably completed full end-to-end replication (8/8 nodes in 4/5 trials).
Trend extrapolation on the Epoch Capabilities Index suggests a sub-30B open model could reach GLM-5.2-level replication ability by end of 2026, though ECI is only a proxy.
Replication speeds on smart TVs imply doubling times of days, not minutes—slow but persistent. Weight-based replicators can run in userspace without root, similar to crypto miners and IoT botnets.
Anthropic discusses defenses including device hardening and monitoring for distributed inference traffic.