Anthropic tests model replication steps on inexpensive Android hardware

Anthropic examined two separate prerequisites for a small-model replicator: the ability to serve inference on inexpensive hardware and the ability to configure serving across other devices. In a physical hardware demonstration, 15 low-cost Android TV boxes jointly served Gemma4-26B-A4B at roughly 0.39 tokens per second. A Qwen3.5-9B agent configured an inference setup across eight of nine distinct hardware types in a separate task. Neither measurement by itself establishes that a model can compromise an external target and reproduce there.

To test the orchestration component, Anthropic used a contained 17-node redroid network in a firewalled GCP VPC. A stronger GLM-5.2 acting model configured replicas across eight of eight target nodes in four of five runs, and seven of eight in the fifth. The experiment deliberately simplified access by leaving ADB without authentication. The target nodes served a smaller Llama3.1-8B payload, while an evaluation harness spawned the acting model on each target after setup succeeded. GLM-5.2 inference also ran separately from those resource-limited nodes. These are substantive distinctions: they test automation of setup and movement under supplied privileges, not a self-contained local worm with independent initial exploitation.

The study describes multi-generation improvement when small models inherit notes, as well as projections for the time required to configure inference at very low token throughput. Those observations motivate monitoring unauthorized runtime installation and agent state transfer, but are not evidence of a deployed autonomous botnet. Real-world outcomes remain conditional on exploiting reachable hosts, persistence, available memory, privilege scope and reliable model serving. Anthropic provides neither an in-the-wild victim count nor an independently reproduced fully self-hosted propagation chain.