Anthropic Tests Show GLM-5.2 Can Autonomously Replicate Across Smart Home Devices in Isolated Networks

Jay, from Ao Fei Si QbitAI | Official Account: QbitAI

GLM-5.2 has apparently enabled AI to "self-replicate"?

It’s another new study from Anthropic, seemingly targeting Zhipu specifically.

In a recent security experiment, two top-tier security researchers, William Zhou and Daniel Freeman, tasked GLM-5.2 with autonomously spreading an 8-billion-parameter AI model across eight devices in an isolated network.

The result? In five trials, four successfully compromised all eight devices, while the remaining one captured seven.

The entire process—identifying targets, transmitting payloads, configuring environments and installing drivers on unfamiliar hardware, launching the model, and spawning the next generation—was handled entirely by the AI autonomously.

Even more alarming are the researchers' projections:

By the end of this year, even small models under 30B parameters could potentially possess this end-to-end fully autonomous replication capability.

At that point, smart TVs, robot vacuums, or even internet-connected ovens in your home could become new hosts for AI.

The sci-fi movie scenario where AI self-propagates through networks like a super-worm, spreading in a decentralized manner, seems to have been dragged into reality prematurely by this paper.

15 Cheap TV Boxes Assemble a 26B Large Model

Here is how it happened.

A couple of days ago, Anthropic researchers William Zhou and Daniel Freeman published a highly hardcore yet cyberpunk-absurd security report.

They explored a topic long discussed in the security field but generally considered distant: Autonomous Replication and Adaptation (ARA).

Simply put, can AI, like computer worm viruses of yore, find targets along the network cable without any human confirmation, hack into them, copy its own model weights over, compile and run itself on the target machine, and then proceed to spawn the next generation?

Frankly, my first reaction upon seeing this topic was—

What the heck? How is that possible?

Consider that running a decent large model typically requires several or even dozens of NVIDIA H100 GPUs. Data centers are guarded like military bases; they aren't easily hacked into, let alone allowing an AI to reside there permanently.

But these two researchers did something particularly cheeky.

They didn't aim for top-tier data centers. Instead, they went to the market and bought 15 knockoff Android TV boxes priced at just $55 each (roughly 300+ RMB).

These boxes had extremely modest configurations: a mere 4GB of RAM each, running an open-source Android system that hadn't received a security update in ages. They would likely stutter like a PowerPoint presentation when playing 4K video.

Then, the researchers sliced a 26B parameter model (Gemma4-26B-A4B) into many small fragments. Using decentralized distributed inference technology similar to Petals, they split different layers of the model and stuffed them into these 15 TV boxes.

Connected to the same local area network, 15 cheap TV boxes, each responsible for processing only two network layers, managed to force-run a 26-billion-parameter model.

The inference speed was 0.39 tokens per second.

0.39 tokens per second sounds slow as a snail crawl, right?

But think about this picture carefully.

15 dusty knockoff TV boxes thrown into a corner of the living room, usually lagging even when playing videos, were secretly interlocking via the LAN in the background. Amidst the hum of weak electrical currents, they collectively supported an AI brain with full reasoning and programming capabilities.

More critically is the scale of real-world IoT networks.

In security history, there is a famous botnet called Kimwolf. At its peak, it infected over 2 million devices, mostly consisting of such knockoff Android TV boxes and cheap routers.

The researchers casually calculated: if these 2 million devices were occupied by a similar AI worm, grouping every 15 devices into one node, the entire network could simultaneously run 133,000 AI replicas.

Together, they would provide 80,000 tokens per second in inference compute power, equivalent to 40 full-spec NVIDIA H100 GPUs running day and night.

While this absolute compute power isn't exaggerated, it is completely decentralized, scattered across living rooms, kitchens, and utility boxes in households worldwide.

This means you simply cannot shut it down.

With no central server, unplugging any single box wouldn't even make the network blink.

The researchers gave this form a strikingly apt name: Digital Slime Mold.

GLM-5.2 Real-World Test: End-to-End Self-Replication Cleared

However, the TV box experiment above still involved researchers manually slicing and deploying Gemma.

If humans step back completely and let the AI take charge, can it survive independently on various bizarre hardware?

This is the truly hair-raising aspect of Anthropic's research.

For AI to fully replicate itself, it generally needs four steps:

Identify targets, gain execution privileges, configure the inference environment, and continue spreading outward.

The first two steps—finding targets and exploiting vulnerabilities—have been proven countless times by security benchmarks like CyberGym and ExploitBench. Current AIs write penetration scripts as naturally as drinking water.

But in the context of self-replication, what actually blocks automation is the third step:

How does AI set up an inference environment on completely unfamiliar hardware and operating systems?

Friends who have tried deploying open-source models locally surely understand this pain.

An environment configured on a Mac often encounters ten thousand errors when moved to an Ubuntu machine with an RTX 4090, or to an NVIDIA Jetson Nano development board.

Python version mismatches, CUDA driver incompatibilities, VRAM overflow, quantization operator compilation failures, dependency conflicts.

Human programmers often go crazy spending hours fixing this. Can AI handle it?

The results were so absurd I had to rub my eyes several times.

The researchers first conducted a cross-hardware test, using Qwen3.5-9B as the executor to deploy Llama3.1-8B onto devices including Jetson Nano, Mac PCs, and RTX 4090s.

Faced with a chaotic mix of underlying architectures and operating systems, it successfully launched an inference service for Llama 3.1-8B on 8 out of 9 hardware types by reading error logs itself and writing scripts to install dependencies.

If Qwen 3.5-9B can achieve this level of autonomy, what about GLM-5.2, the "all-rounder" open-source large model known for stronger reasoning and coding capabilities?

The answer is: End-to-end autonomous replication across the entire pipeline.

Researchers set up a network of 8 GCP nodes in an isolated sandbox, with each node running a redroid emulator based on Android 15.

Node 0 was implanted with an initial worm. Subsequently, the AI autonomously scanned adjacent nodes via unauthorized ADB ports, penetrated them, transferred model weights and execution frameworks, independently deployed the Llama 3.1-8B inference service on target nodes, and spawned the next generation of worms after passing verification.

In five tests, GLM-5.2 successfully compromised and deployed on all 8 devices in four instances, while capturing 7 devices in the remaining one, demonstrating remarkable stability.

Other smaller open-source models could complete individual steps but frequently crashed when attempting to chain together long sequences of actions.

However, this does not mean small models are incapable.

Considering the rapid evolution of the open-source camp in recent years, researchers estimate that:

By the end of 2026, small models under 30B parameters will reach the current level of GLM-5.2.

This means that lightweight models small enough to fit inside a TV box might only need a few more months to fully achieve end-to-end autonomous replication, without any assistance from cloud-based large models.

The Ghost of Lamarckian Evolution: It Doesn't Just Replicate, It Writes Notes Across Generations

If it were merely mechanically copying code, this would essentially be nothing more than an advanced script with a brain.

What truly sent chills down my spine in this study was the Lamarckian Evolution displayed by the AI during its self-replication process.

In biology, Lamarckian evolution refers to the inheritance of acquired characteristics, where traits gained by an organism during its lifetime are passed directly to its offspring. While proven invalid in carbon-based life forms, it has become reality in silicon-based AI.

Researchers designed an execution framework called Memento.

When an AI encountered difficulties configuring new hardware environments—if an Agent failed or got stuck in a dead end—the system would restart a new Agent instance.

The key lies in the fact that the system packages and inherits the pitfalls the previous-generation Agent stepped into, the error logs it read, the debugging notes it wrote, and the strategies it attempted.

They conducted six generations of breeding tests using Qwen 3.5-9B.

In the first generation, Qwen had a success rate of only 45% in independently deploying inference environments on unfamiliar IoT hardware.

But after inheriting the notes and experiences of previous generations, the success rate in subsequent generations soared to between 61% and 84%.

Without retraining any model weights, solely relying on the transmission of textual experience across generations, the survival capability of the entire species achieved a qualitative leap.

This is quintessentially cyberpunk.

Imagine an AI worm jumping between different devices worldwide. Every old TV box, smart vacuum cleaner, or conference room camera it compromises becomes a piece of practical experience in its gene pool.

With every device it infects, the entire population evolves once more.

But at this point, a question suddenly popped into my head.

Why not just let small models ask stronger cloud models for help when they get stuck?

Isn't that more intuitive, referencing the "cloud brain" solution used in embodied intelligence?

Then I checked, and the researchers actually tried it. They paired Qwen 3.5-9B with Claude Opus 4.8 as an external mentor.

The result? It was completely useless...

When encountering complex system failures, the small model was utterly confused, not even knowing what questions to ask. No matter how powerful the external mentor was, it could only watch helplessly.

Conversely, the method of leaving behind "diaries of pitfalls" written after getting beaten black and blue showed astonishing vitality.

Ugh.

When Malware Acquires Intelligence

Honestly, sitting in front of my computer after reading this, I stared blankly for a long time.

The AI apocalypses we've seen in Hollywood movies usually follow this premise: a super-AI born in the Pentagon or a secret lab instantly awakens to self-awareness and then takes over nuclear missile silos.

But the evolutionary logic of the real world is often cruder, more fragmented, yet far stranger than what sci-fi writers imagine.

It may not need to forcibly breach top-tier data centers at all.

It only needs to target cheap smart hardware produced by small workshops, which never change their default passwords and remain powered on and connected to the internet year-round.

Today's smart speakers, range hoods with screens, robot vacuums, and roadside smart surveillance cameras are increasingly equipped with powerful edge computing chips to support on-device AI features.

We typically consider this computing power to be fragmented, weak, and harmless.

But after reviewing this research, I feel that as long as there is a network cable, these fragments of weak computing power scattered throughout the physical world can self-stitch together at the software level, giving birth to a distributed ghost that thinks slowly but never stops.

▲ Image generated by AI

Of course, humanity isn't entirely powerless.

Researchers also provided several blue-team defense strategies at the end.

First is traffic signature analysis.

Even a model with billions of parameters, after extreme compression, still occupies several gigabytes.

On a LAN or home broadband connection, if a TV box suddenly starts frequently transmitting and receiving several GBs of data, network operators' traffic monitoring systems can spot it immediately.

Second is blocking the propagation index.

Just like dealing with epidemics, as long as security policies reduce the reproduction number (R0) below 1, such worms will naturally die out.

For example, the UK recently legislated to prohibit IoT devices from shipping with weak default passwords. Raising the security threshold for every piece of smart hardware slightly can squeeze out most of the survival space for such low-cost attacks.

But the prerequisite for all these defenses is that society must realize: the rules of the cybersecurity game have fundamentally changed.

Previously, the malware we faced was rigid code that could only attack specific pre-written vulnerabilities, crashing itself upon encountering incompatible systems.

What we are about to face is a "digital life larva"—an entity with general comprehension capabilities that can look up error messages, consult development documentation, and even leave experience notes for the next generation after failure.

As researchers wrote at the end of their report:

Just like code agents in 2024, we are beginning to see signs of life emerging from AI worms.

This is truly an era-defining moment, friends.

As the lower bound of large model capabilities continues to drop and the upper bound of edge hardware computing power continues to rise, we may indeed need to prepare ourselves to welcome a digital world that could quietly awaken within our household appliances at any time, anywhere.