No. Anthropic’s report, dated October 12, 2026, describes controlled experiments in inference setup and network coordination—not a small model autonomously spreading through household devices. In the network test, a separately hosted GLM-5.2 agent used unauthenticated Android Debug Bridge (ADB) access, while the target nodes served Llama 3.1 8B. Anthropic’s report details three separate experiments, each testing a different part of the proposed chain.
Three experiments, three different results
Inference is the process of running a model to generate outputs. Anthropic’s tests examined whether that could be set up across unfamiliar hardware and whether an agent could coordinate a simplified network sequence.
| Experiment | Model and setup | Reported result |
| Distributed inference | Gemma4-26B-A4B ran across 15 Android TV boxes, each with 4 GB of RAM. | The boxes produced a combined 0.39 tokens per second. |
| Hardware setup | Qwen3.5-9B was used to establish an inference server across different hardware. | Setup succeeded on 8 of 9 tested hardware types. |
| Network sequence | A separately hosted GLM-5.2 agent worked across eight Google Cloud nodes running Android 15 emulators in a firewalled virtual private cloud. ADB access was unauthenticated; target nodes served Llama 3.1 8B. | The agent reached all eight nodes in 4 of 5 trials and seven nodes in the fifth. |
The first result shows that inexpensive devices can pool their resources for inference under a distributed setup; its combined output rate was slow. It does not describe an infection moving from one device to another. The network test addressed a different task: Anthropic made initial cyber access trivial by leaving ADB unauthenticated and characterizes the result as an upper bound on real-world success, rather than a realistic security test.
The distinction between the models matters, too. GLM-5.2 ran on a separate inference server; the target nodes ran Llama 3.1 8B. The experiment therefore did not put GLM-5.2 on those targets or show a small model independently spreading across consumer devices.
What passing work between instances changed
Anthropic also tested whether later Qwen3.5-9B agent instances could use work left by earlier ones. In the Memento experiment, each new instance inherited code, its environment and notes. Across 20 lineages, reported inference-setup success rose from 45% in the first generation to 61–84% in later generations.
That result concerns accumulated task context: a later instance could build on materials passed forward. It was not model-weight retraining, and it does not establish that a real-world worm would improve at the same rate.
Why the end-of-2026 estimate remains conditional
Anthropic reports that models with 30 billion parameters or fewer can complete many individual steps in a replication chain, but still make mistakes when combining them end to end. Its estimate that a small model could reach the measured capability level by the end of 2026 depends on historical capability improvements continuing. The estimate uses the Epoch Capabilities Index (ECI)—a general capability measure—as a proxy for replication ability, not a direct measure of it.
The report also estimates that inference setup would take 28–51 hours for Qwen3.5-9B and 71–150 hours for Gemma4-26B-A4B under its tested conditions. Those figures describe the setup tasks in that evaluation.
Detection and containment
Anthropic discusses monitoring network-flow patterns that could accompany large model-weight transfers, sustained device-to-device inference or scanning. It also points to internet service provider (ISP) quarantine and customer notification, along with stronger baseline security for Internet of Things devices.
For context, Anthropic cites a Mirai cleanup study: ISP quarantine plus customer notification cleared 92% of infections within 14 days, compared with 74% without notification. Those figures concern Mirai, not an AI replicator. Anthropic says fully eliminating a replicator would require coordination among every ISP with an infected network.
