By Jay, from QbitAI
QbitAI | Official Account QbitAI
GLM-5.2 can already make AI 'self-replicate'?!
Yet another new study from Anthropic — they're clearly keeping a close eye on Zhipu.
Two top security researchers, William Zhou and Daniel Freeman, in a recent security experiment had GLM-5.2 attempt to autonomously spread an 8 billion (80 hundred-million)-parameter AI model across 8 devices on an isolated network.
The result: across 5 experiments,4 times it took over all 8 devices, and the remaining 1 time it took over 7.
The entire process — finding targets, transferring payloads, setting up environments and installing drivers on unfamiliar hardware, launching the model and spawning the next generation — was all done autonomously by the AI.
Even more alarming is the researchers' extrapolated prediction:
by as early as the end of this year, even small models under 30B may possess this kind of end-to-end fully autonomous replication capability.
At that point, smart TVs at home, robot vacuums, and even internet-connected ovens could all become new hosts for AI.
The sci-fi movie scene of AI self-propagating across networks like a super worm, spreading in a decentralized way, seems to have truly been dragged into reality ahead of schedule by this paper.
15 cheap TV boxes pieced together into a 26B large model
Here's what happened.
A couple of days ago, two Anthropic researchers, William Zhou and Daniel Freeman, published an extremely hardcore security report full of cyberpunk absurdity.
They explored a topic that has long been discussed in the security field but always felt far off —Autonomous Replication and Adaptation (ARA)。
Put simply: can AI, like the computer worm viruses of yesteryear, without any human confirmation, follow the network cable to find targets, hack in, copy its own model weights over, compile and run itself on the target machine, and then continue to spawn the next generation?
Frankly, my first reaction upon seeing this topic was —
What on earth? No way.
Think about it: running a decent large model nowadays often requires several or even dozens of NVIDIA H100 GPUs, and data centers are guarded as tightly as military bases — how could AI so easily hack in and set up residence?
But these two researchers did something particularly wild.
They didn't go after top-tier data centers at all; instead, they went straight to the market and bought15 knockoff Android TV boxes priced at only 55 US dollars (about 300-plus RMB)。
The specs of these boxes are extremely meager: each has a pitiful 4GB of RAM, runs an open-source Android system whose vendor hasn't issued security updates in ages, and might stutter like a slideshow even playing a 4K video.
Then, the researchers took a26B-parameter model (Gemma4-26B-A4B), cut it into many small fragments, and, using decentralized distributed inference technology similar to Petals, split the model's different layers and stuffed them into these 15 TV boxes.
15 cheap TV boxes connected to the same local area network, each one responsible for processing only two layers of the network, and just like that they brute-forced a 26 billion (260 hundred million) parameter model into running.
The inference speed is,0.39 tokens per second。
0.39 tokens per second—sounds slow as a snail crawling, right?
But take a closer look at this picture.
15 knockoff TV boxes, dumped in a corner of the living room and covered in dust, usually stuttering even when playing videos, yet in secret, through the local area network they quietly meshed together, and amid a faint hum of electric current, they jointly propped up an AI brain with full reasoning and coding capabilities.
Even more daunting is the scale of real-world IoT networks.
In security history there is a famous botnet called Kimwolf, which at its peak infected more than2 million devices, most of which were exactly this kind of knockoff Android TV boxes and cheap routers.
A researcher casually did the math: if these 2 million devices were taken over by a similar AI worm, with every 15 devices combined into one node, the whole network could run simultaneously133,000 AI copies。
, which together could provide80,000 tokens per secondof inference compute, equivalent to40 fully-powered NVIDIA H100 GPUsrunning around the clock.
Although this compute is not exaggerated in absolute terms, it is completely decentralized, scattered across the living rooms, kitchens, and weak-current boxes of millions of households worldwide.
This means you simply cannot shut it down.
There is no central server; unplug any single box, and the entire network would not even blink.
The researcher gave this form an extremely evocative name:Digital Slime Mold。
GLM-5.2 tested in practice: end-to-end self-replication cleared
That said, the TV box experiment above was still the result of researchers manually helping Gemma slice and deploy itself.
If it relied on no human intervention at all, letting the AI go into the field itself, could it survive independently on all kinds of bizarre hardware?
This is where Anthropic's research truly makes your hair stand on end.
For an AI to copy itself out completely, it generally needs four steps:
finding a target, obtaining execution privileges, configuring the inference environment, and continuing to spread outward.
The first two steps, finding targets and exploiting vulnerabilities, have been proven countless times by security benchmarks like CyberGym and ExploitBench; today's AI writes a penetration script as naturally as drinking water.
But in the self-replication scenario, what actually stalls the automation is the third step:
how can an AI set up its own inference environment on a completely unfamiliar hardware and operating system?
Anyone who has ever fiddled with local deployment of open-source models surely understands this.
An environment you set up on a Mac, when moved to an Ubuntu machine with an RTX 4090, or onto an NVIDIA Jetson Nano dev board, often runs into ten thousand kinds of errors.
Wrong Python version, mismatched CUDA drivers, out-of-memory VRAM, quantized operator compilation failures, dependency package conflicts.
Even human programmers often go crazy over this for hours, so can an AI handle it?
The result was so absurd I rubbed my eyes several times.
The researcher first did a cross-hardware test, usingQwen3.5-9Bas the executor, asking it toLlama3.1-8Bdeployed onto devices such as the Jetson Nano, Mac PC, and RTX 4090.
Faced with all kinds of messy underlying architectures and operating systems, it read the error logs by itself and wrote scripts by itself to install dependencies on 8 out of 9 kinds of hardware, successfully bringing up the Llama3.1-8B inference service.
If Qwen3.5-9B can reach this level, what happens when you swap in GLM-5.2, a well-rounded open-source large model with stronger reasoning and coding?
The answer is:end-to-end, fully autonomous replication across the entire chain.
The researchers set up a network inside an isolated sandbox containing 8 GCP nodes, with the nodes running redroid emulators based on Android 15.
Node 0 was implanted with the initial worm, after which the AI itself, entirely on its own, scanned neighboring nodes via unauthorized ADB ports, penetrated them, transferred model weights and execution frameworks, independently deployed the Llama3.1-8B inference service on the target nodes, and, after passing verification, hatched the next generation of worms.
Across 5 test runs,GLM-5.2 successfully compromised and deployed on all 8 devices in 4 of them, and in the remaining 1 it still took over 7 devices, demonstrating astonishing stability.
Other smaller open-source models, while capable of completing individual steps, still crashed frequently when chaining together long sequences.
But this does not mean small models cannot do it.
Given the lightning-fast evolution of the open-source camp in recent years, the researchers estimate that
by the end of 2026, small models below 30B will reach the level GLM-5.2 is at now.
In other words, even lightweight models small enough to fit inside a TV box may, in just a few more months, fully achieve end-to-end autonomous replication, with no need for assistance from large cloud-based models at all.
The ghost of Lamarckian evolution—it not only replicates but also takes notes across generations
If it merely copied code mechanically, this thing would at best be a sophisticated script with a brain.
But what truly sent a chill down my spine in this research was what the AI displayed during its self-replication process:Lamarckian Evolution (Lamarckian Evolution)。
In biology, Lamarckian evolution refers to the inheritance of acquired traits—that is, characteristics an organism acquires during its lifetime can be directly passed on to the next generation. This has been proven false for carbon-based life, but in silicon-based AI, it has become reality.
The researchers designed a runtime framework called Memento.
When the AI runs into difficulties configuring new hardware environments—if an Agent screws up or hits a dead end—the system restarts a new Agent instance.
But the key is that the system packages up and passes down thepitfalls stepped into by the previous generation of Agents, error logs they saw, debugging notes they wrote, and strategies they triedall of it, in full.
They ran a 6-generation reproduction test with Qwen3.5-9B.
When facing unfamiliar IoT hardware, the first-generation Qwen's success rate at independently deploying an inference environment was only45%。
but after inheriting the notes and experience of previous generations, by the later generations,the success rate soared directly to 61% to 84%。
No model weights were retrained; purely through the transfer of textual experience between generations, the entire species' survivability achieved a qualitative leap.
That's very cyberpunk.
Think about it: when an AI worm jumps between different devices around the world, every shabby TV box, robot vacuum, or camera-equipped conference machine it conquers becomes a piece of combat experience in its gene pool.
Every time it infects a device, the entire population evolves once.
But at this point, a question suddenly popped into my head.
Why not simply have the small model ask a stronger cloud-based model for help when it gets stuck?
Wouldn't that be far more intuitive—just like the cloud-brain approach in embodied intelligence?
Then I looked, and it turns out the researchers actually tried it: they paired Qwen3.5-9B with Claude Opus 4.8 as an off-site mentor.
The result:completely useless...
When facing complex system failures, the small model was utterly dumbfounded—it didn't even know what questions to ask, so no matter how powerful the off-site mentor was, it could only watch helplessly.
Instead, it was the approach of writing pitfall diaries after beating oneself black and blue and leaving them to the next generation that showed astonishing vitality.
Ugh, ugh, ugh.
When malware gains an IQ
Honestly, seeing this, I sat frozen in front of my computer for a long time.
The AI apocalypses we've watched in Hollywood movies usually follow this setup: a super-AI born in the Pentagon or a secret laboratory instantly awakens to self-awareness and then takes over nuclear missile silos.
But the logic of how things evolve in the real world is often far rougher, more trivial, and much stranger than science fiction writers imagine.
It may not need to force its way into top-tier data centers at all.
It only needs to set its sights on those cheap smart hardware devices—produced by small workshops, never even changing their default passwords, and powered and connected to the network year-round.
Today's smart speakers, range hoods with screens, robot vacuum cleaners, and street-side smart surveillance cameras all increasingly carry more and more powerful edge computing chips in order to deliver on-device AI features.
We usually think of this computing power as fragmented, weak, and utterly harmless.
But after reading this research, I think thatas long as there is a network cable, this weak computing power scattered across every corner of the physical world can stitch itself back together at the software level, giving birth to a distributed ghost that thinks slowly but never stops.
▲ Image generated by AI
That said, humanity is not entirely without options.
At the end, the researchers also offered several blue-team defense ideas.
The first is traffic signatures.
Even after extreme compression, a model with several billion parameters is still several gigabytes in size.
On a LAN or a home broadband connection, if a TV set-top box suddenly starts pushing and pulling several gigabytes of data at high frequency, the network operator's traffic monitoring system will spot it at a glance.
The second is blocking the reproduction index.
Just as in dealing with an epidemic, as long as security policies push the transmission coefficient R0 below 1, the worm will die out on its own.
For example, the UK has recently enacted legislation banning weak default passwords on IoT devices out of the factory. Raising the security bar for every piece of smart hardware by a little can squeeze out more than half of the survival space for this kind of low-cost attack.
But the premise of all these defenses is that society as a whole must realize thatthe rules of the cybersecurity game have completely changed。
The malware we faced in the past was a rigid piece of code: it could only attack specific vulnerabilities that had been written in advance, and it would crash on its own when it encountered an incompatible system.
What we are about to face is a "digital life in its infancy" that possesses general-purpose comprehension, can look up error messages on its own, consult development documentation, and even leave experience notes for the next generation after a failure.
As the researchers wrote in the closing line of their report,
Just like the code Agents of 2024, we are now seeing AI worms show signs of life.
What an era, my friends.
As the capability floor of large models keeps sinking, and the compute ceiling of edge hardware keeps rising, we may truly need to prepare ourselves for a digital world that could quietly awaken at any moment, anywhere, inside an appliance in our living room.