Anthropic’s researchers estimate that AI models small enough to run on $55 TV boxes could copy themselves from device to device by the end of 2026, as one larger model already did in a test.
Researchers at Anthropic said an AI model worked through every step of copying itself from machine to machine on its own inside a sealed-off test network. The model, GLM-5.2, is too large to run on inexpensive home devices. But the researchers estimate that AI models small enough to run on those devices could do the same by the end of this year.
A self-copying AI program built on small models would live on poorly secured devices that homes and businesses already own, such as smart TVs, security cameras and video-conferencing units. There would be no single place to switch it off.
One model completed every step in Anthropic’s test
The researchers rented eight computers running Android, the operating system many cheap TV boxes use, and connected them to a network walled off from the internet. GLM-5.2 is too large for those machines, so it ran on a separate computer and directed an AI program that started on one of them.
The researchers placed a small program on the first test machine. From there, the test ran in three steps:
- The program did whatever GLM-5.2 told it to do, sending each request over the network to the separate computer where GLM-5.2 ran.
- Following GLM-5.2’s instructions, the program found another machine, broke in, copied its files, and got a small AI model running there.
- Once that worked, a copy of the program started on the new machine, took instructions from GLM-5.2, and looked for the next machine.
GLM-5.2 installed a small model because that is the size that fits on cheap devices, and GLM-5.2 is too big to fit on them. Anthropic is concerned that future small AI models will be as capable as GLM-5.2 and could install themselves on a cheap device, doing all of this by themselves.
Anthropic tested four publicly downloadable AI models: Qwen3.5-9B, Gemma4-26B-A4B, Qwen3-Coder-Next and GLM-5.2. The first three didn’t get the program onto a single other machine in any of their five or six tries. GLM-5.2 reached all eight machines in four of five tries, and seven in the fifth.
The researchers made the break-in step easy on purpose: the machines accepted connections without a password. Real devices could be harder to get into. But Anthropic points out that real attacks have gotten in almost as easily. In 2016, an attack called Mirai took control of internet-connected cameras and video recorders by trying the usernames and passwords that manufacturers set at the factory. It then used those devices in an attack that caused outages at sites including Twitter, Amazon, Reddit and Netflix.
Small models that fit on cheap devices are catching up
To show that cheap devices can run AI, the researchers bought 15 off-brand Android TV boxes for about $55 each and connected them. The AI model they used, Gemma4-26B-A4B, was too big to fit in one box’s memory, so they split it into 15 pieces, one per box. Each box did its share of the work and passed it to the next. Together, the boxes ran the model, though at well under one word per second, far slower than a chatbot.
In another test, Anthropic gave a small model, Qwen3.5-9B, a computer or device it had never worked on and asked it to install an AI model there and get it running. It did this on its own on 8 of the 9 hardware types tested, ranging from a small Nvidia computer board called the Jetson Nano to a Mac. Small models can already do many individual steps of copying themselves, but they make mistakes when they have to do them all in a row.
Anthropic tracked small models over time on the Epoch Capabilities Index, a scorecard that rates AI models’ overall abilities. If small models keep improving at their past pace, the best one would match GLM-5.2’s score by the end of 2026. Anthropic calls this a rough estimate, because the scorecard measures overall ability, not the specific skill of copying itself.
Internet providers and device makers could slow a self-copying program
A self-copying AI program would leave a trail. Each new device would receive files several gigabytes in size, and infected devices would send unusual amounts of data to each other. Internet providers already monitor unusual traffic on their networks, and they would see it. The faster the program spread, the more traffic it would produce.
When Mirai spread, one internet provider cut infected customers off from all but a short list of websites and sent them cleanup instructions. That cleared infections for 92% of its customers within 14 days. Device makers can also stop shipping devices with default passwords, which the UK already bans.
No working self-copying AI exists yet
Anthropic describes its results as “signs of life,” meaning early evidence that a self-copying AI program is possible, not a working one. It expects AI programs to run on all kinds of hardware, including some programs outside human control. It says computer systems should be made harder to break into, and that people should prepare for self-copying AI programs to be here to stay.
