Anthropic tests AI replication on everyday connected hardware
Anthropic’s October 12, 2026 study examines whether small models could run and replicate across ordinary connected devices. Its researchers report progress in individual capabilities, with major limits in the combined demonstration.
The team found Qwen 3.5 9B could establish inference on eight of nine hardware types. Its Memento harness periodically restarted agents with inherited notes.
What the experiment established
A separate test used eight isolated Android emulators and deliberately trivial initial access. GLM 5.2 reached all eight nodes in four of five trials and seven in the remaining trial. Crucially, the agent’s inference ran on a separate server while it deployed Llama 3.1 8B.
Anthropic reports no full rogue replicator. Its year end forecast extrapolates capability trends rather than demonstrating autonomous spread in the wild.
Earlier experiments used different conditions
The broader research question predates this report. A June 2, 2026 preprint by Jonas Guan and colleagues describes an adaptive computer worm powered by a locally hosted language model. The authors ran 15 independent experiments on an isolated network of 33 machines, including Linux, Windows and connected devices. Each trial ran for seven days.
That study reported propagation to an average of 20.4 machines. The main experiments used a shared pool of inference servers rather than physical GPUs attached to the target machines. This distinction matters when interpreting claims about malware running on everyday hardware. Reaching a device does not necessarily mean the entire reasoning model fits on it.
The authors also describe substantial limits. Every target had an exploitable weakness, and the network lacked active endpoint defences. Their experiment tested adaptation across deliberately vulnerable systems. It did not establish success against a typical defended production network.
Replication involves several separate capabilities
RepliBench, first submitted on April 21, 2025 and revised on May 5, offers another useful framework. It divides replication into obtaining resources, moving model weights, deploying onto computing infrastructure and persisting there. Its 86 tasks across 20 families were designed to expose gaps that a single successful demonstration could miss.
The five models tested in that older study could complete many components, but the researchers found weaknesses in identity checks and durable deployment. Those results concern the models evaluated then. They should not be treated as current capability scores or directly compared with a different experimental setup.
For readers assessing replication claims, the useful questions are concrete. What resources were supplied, which steps did the system complete, and how long could it keep operating? Separating those requirements makes both reported progress and remaining gaps easier to evaluate.
Our report on Irregular’s containment checks explains why evaluation results depend on the tested tools, permissions and infrastructure.
