On 12 October 2026, Anthropic’s Frontier Red Team published research suggesting small AI models may be months away from being able to copy themselves across commercial internet-connected devices, such as smart ovens and off-brand Android TV boxes. As a demonstration, the team ran Google’s Gemma4-26B-A4B model across 15 networked TV boxes that cost about US$55 each.
This is a projection, not an outbreak. Anthropic is clear that today’s small models still make mistakes when they chain the replication steps together. But the direction is the point, and it changes how anyone running AI outside a data centre should think about control.
Why it matters
For years, a quiet assumption sat under AI safety: powerful models live in a small number of large, monitored server farms, and whoever runs those farms can switch them off. Anthropic’s findings show that assumption weakening.
The numbers in the research are specific. A 9 billion parameter model got inference running on 8 of the 9 hardware types tested, from Jetson Nanos to Macs. In a simplified test network with an unauthenticated access port, a worm driven by GLM-5.2 spread to all 8 nodes in 4 of 5 trials. On historical improvement rates, Anthropic expects small models to reach that level by the end of 2026. And a model split across many weak devices has, in Anthropic’s words, “no centralized point to shut off.”
The detail most people will skip is the most useful one. Anthropic estimates there are roughly 9.5 million NVIDIA-powered edge devices in the field, and notes that most are reached through outbound management connections rather than open ports. It also notes there has been no historical mass compromise of accelerator-equipped edge devices, unlike cheap smart TV boxes. The Kimwolf botnet Anthropic uses as its model infected over 2 million of those.
In other words, the soft target is not edge AI. It is edge compute that nobody is managing.
What it means for operators
Compute without an owner is any machine that can run a model but has no operator who knows what is running on it, who put it there, or how to stop it. That is where a self-replicating model would live.
The response is not to pull AI back into the cloud. The sites that most need AI, from power grids to ground stations to defence systems, are exactly the sites that cannot depend on a connection. The response is to make sure every machine that runs a model has an owner. In practice, that means four questions every operator should be able to answer for every site, which match the sovereignty test we set out in what sovereign AI actually means:
- Who holds the keys? Only signed, approved workloads should be able to land on a machine.
- Who chooses the models? An inventory of which model runs on which device, so an unknown one stands out.
- Who keeps the record of what ran? A durable log of what ran and when, which is how anomalies get noticed.
- Who can stop the system? A stop that works at the site, even when the network is down or untrusted.
Anthropic’s own suggested defences point the same way: network monitoring that spots unusual traffic, quarantine of infected devices, and manufacturers moving to secure defaults. All of them work better when someone is accountable for the device.
This also connects to what we wrote about data centres becoming physical targets. Resilience and control are the same problem from two sides. AI at the edge must keep working when a facility or link is lost, and it must stay under the operator’s command when someone, or something, tries to take it over.
Where Sector88 fits
Sector88 is one system to deploy, run and govern AI at every site, connected or completely cut off. Operators decide what runs on each machine and keep a durable record of what ran, whether the site is online or not. See how it works on the Sector88 platform.
The danger is not AI at the edge. It is compute nobody owns.