Anthropic Report: Device Makers and ISPs, Not Labs, Can Stop AI Self-Replication── The point where spread can be stopped lies with device defaults and ISP monitoring, not with model developers

On 12 October 2026, Anthropic's Frontier Red Team reported that small AI models may be only months away from copying themselves onto cheap household devices, with no datacenter involved. Once an AI model starts copying itself across cheap devices, who actually holds the means to stop it? Not the developer that trained it. The levers sit with the device makers who set factory defaults and the internet service providers who can see the traffic, and what remains for any organisation using AI is to count the devices on its own network and lock them down.

01Anthropic estimates small AI models could self-replicate before the year ends

William Zhou and Daniel Freeman of Anthropic gave openly released AI models a task: copy yourself to another machine and get running there. Replication, in this report, means a model sending its own weight files to a new device, starting inference on that device, and then moving on to the next one. Of the open-weight models tested, only GLM-5.2 managed the whole loop from start to finish.

Smaller models are close behind. Models with 30 billion parameters or fewer can already complete many of the individual steps. When they try to chain those steps together, they make mistakes partway through. The report projects that if small models keep improving at their historical rate, they will reach GLM-5.2's level by the end of this year.

The defences the report lists are monitoring of network traffic, decoy devices, and quarantining infected devices while notifying their owners. All three work on the network and device side; none is a way for the company that built the model to stop weights it has released.

My own reading is that the first job for an organisation using AI is plain arithmetic: count the cheap devices plugged into its network. The TV box in the meeting room and the Android gadget someone bought to try out are the ones I would count first.

02Only GLM-5.2 finished the full loop, and the break-in step was left out

The level the year-end estimate aims at is what GLM-5.2 did inside a small test network of eight devices. In four of five trials it spread to all eight. In the remaining trial it reached seven.

Those figures come from a test with the hard part softened. ADB is the Android Debug Bridge, a connection that lets a computer control an Android device. The test devices left that port open, and the port required no authentication. The difficulty of breaking into a real device was therefore not measured. The numbers are best read as an upper bound on what could happen.

The four rows point the same way. Small models already run on cheap hardware. Within these tests, the missing piece is the ability to string the steps together and finish. The difficulty of breaking in is not in any of these figures.

03The first host for copies is a $55 TV box, and such devices sit outside any premarket check

A 9B model running on eight of nine hardware types tells us that, within what was tested, possible targets are not limited to one kind of device. The hardware tested included off-brand Android TV boxes priced at roughly $55 each.

Al Jazeera reported that the first targets would likely be internet-connected devices in homes and small businesses. These are the small gadgets, from streaming boxes to appliances, that people rarely think of as computers.

Some of these devices are already regulated. Since 29 April 2024, the United Kingdom has barred the sale of consumer connected products with guessable default passwords. Each password must be unique per product, or set by the user. The UK rules place the duty on sellers and manufacturers; they do not create a regulator who inspects each device before sale.

In the United States, the FDA has required cybersecurity documentation in premarket submissions for internet-connected medical devices since 29 March 2023. Medical devices therefore have their defences looked at before they reach the market.

The TV boxes Anthropic tested are not medical devices, so they fall outside FDA-style premarket review. The UK rules also place the duty on sellers, so how well these boxes are protected depends on how firmly the manufacturer set the defaults at the factory.

04With no central off-switch, a developer cannot recall weights it has released

If cheap boxes can host the copies, the next issue is who can stop a model once it has scattered across them. The report says plainly that a self-replicating model has no centralised point to shut off.

An AI running in a datacenter is a different case. ChatGPT and Claude run on their providers' computers. Users can reach them only while the provider keeps the service running, and the provider can switch the servers off.

Open-weight models work differently. Open-weight means the model's weight files are published, so anyone can run the model on their own hardware. A file once distributed cannot be recalled by the company that made it. If copies spread across many devices, there is no obvious list of machines to switch off.

Al Jazeera relayed the same point: without a central host, replicating AI would be hard to shut down. It is not only labs such as Anthropic, which did not build the scattered model, that cannot stop it. The company that released GLM-5.2 cannot reach its own weights once they are out either.

I think this is where much of the public argument goes off course. Demanding that a developer stop self-replicating models asks for something the developer has no tool to do.

05When ISPs notified customers, 92% of Mirai infections cleared within 14 days

If developers lack the tools, the tools must sit somewhere else. Add device defaults to the three measures the report names and there are four, each held by a different party.

Traffic monitoring works because replication leaves marks on the network. Sending a large model file produces traffic that does not look like ordinary use. The report says this would show up as an anomaly in the flow-based monitoring that ISPs already run.

A honeypot is a device deliberately set up to look weak. Researchers can let a replicator land on it, capture what arrives and study how it behaves.

The one measure with numbers behind it is quarantine with notification. Mirai was the malware that hijacked large numbers of IoT devices in 2016. According to the report, when ISPs quarantined infected customers and told them, 92% of infections were cleared within 14 days. Without notification the figure was 74%.

That is a gap of 18 points. My reading is that owners who were told went on to fix or unplug their devices. The report does not break the figure down that far, so this part is my inference.

06The work of stopping it splits among makers, ISPs and the organisations that plug devices in

When ISPs quarantined and notified owners, 92% of infections cleared within 14 days, 18 points more than without notification. Parties outside the developer can hold back the spread. The report frames the defenders' goal as driving R₀ below 1. R₀ is the number of new devices each infected device goes on to infect. Once it falls below one, an outbreak eventually dies out.

The first lever is the manufacturer's default settings. The number of devices that could host copies depends on the settings they carry when they leave the factory. The UK rules have already taken guessable default passwords off the market there. Fewer weak passwords and fewer open ports mean each infected device has fewer neighbours it can reach.

The second lever is ISP monitoring and notification. When a copy moves from one device to another across the line, the party placed to see that traffic from outside is the line provider. The Mirai figures, 92% against 74%, are the results with and without someone in a position to tell the owner.

The third lever is the inventory kept by whoever plugs devices into a network. The targets in the report were cheap, weakly protected devices. A TV box on a company network could become a host for copies. That is my inference from the report; no case of replication inside an organisation's network has been reported. What an organisation can do is list the devices and close the ports it does not use.

07The year-end timing rests on a general capability index, not on replication tests

One input to when the three parties need to act is how firm the year-end estimate is. Looking at the basis for it, there are limits.

The projection extends the growth of an index called ECI. ECI summarises the general capability of AI models and does not measure replication directly. Anthropic itself writes that ECI is only a proxy for replication ability.

The other limit lies in the test conditions. GLM-5.2's result came through an open, unauthenticated port. How fast a replicator would spread across real homes and workplaces has not been measured. Fully autonomous replication in the wild has not been observed either.

Even so, I do not treat these open questions as a reason to wait. Changing factory defaults takes time, and so does building a device inventory. An organisation that starts counting only after replication has been observed will begin by finding out which devices are on its network, at the moment it most needs that answer already in hand.

When AI self-replication starts to spread, the means to stop it do not sit with the developer that released the model. They sit with device makers who set the defaults and with ISPs who can see traffic and tell owners.

The only means left to an organisation using AI is to count and lock down the devices on its own network. If I were starting tomorrow, I would check whether the meeting-room TV box and that trial Android gadget are on the company network.