> ## Content Index
> Fetch the complete content index at: https://www.frontiermodels.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Anthropic reports GLM-5.2 coordinated replication across eight Android emulators
- URL: https://www.frontiermodels.com/news/anthropic-reports-glm-5-2-coordinated-replication-across-eight-android-emulators/
- Published: 2026-10-13T15:07:53.000Z
- Updated: 2026-10-13T15:07:53.000Z
- Description: GLM-5.2 completed the simplified chain in four of five trials. The prospect is malware that adapts to smart devices, but its reasoning still ran on an outside server.
- Author: Frontier Models Desk
- Tags: News, models-research, anthropic, glm, qwen, gemma

Anthropic researchers report that GLM-5.2 coordinated a simplified replication chain across eight emulated Android devices, reaching every node in four of five trials and seven in the fifth. The result points to a consequential possibility: malware that can work out how to run on unfamiliar smart devices, then keep spreading.

In separate tests, a smaller model established AI inference, the process of running a trained model, on eight of nine hardware types. Together, the findings suggest a route toward malicious software that could troubleshoot its setup on varied hardware and use compromised devices’ own processors. But the successful replication chain still relied on a large model reasoning on an outside server. No consumer devices were infected.

8/8 nodesGLM-5.2 reached every emulated node in four of five trials, Anthropic reports

8/9 hardware typesQwen3.5-9B established inference in a separate Anthropic test

In their [October 12 report](https://www.anthropic.com/research/self-replicating-ai?ref=frontiermodels.com), researchers William Zhou and Daniel Freeman focus on an underexamined part of replication: getting a model working after gaining access to a machine. That can require choosing compatible software and debugging problems specific to the hardware. A program that handles those obstacles could reach beyond the devices its author explicitly prepared it for.

GLM-5.2 was the only tested open-weight model to complete the full simplified chain. The targets were eight Google Cloud machines running an Android 15 emulator inside a firewalled network. Their Android Debug Bridge, or ADB, access required no authentication, removing a major obstacle that malware might encounter outside the lab.

What ran where 

GLM-5.2 made decisions on a separate inference server. It configured each target to run Llama3.1-8B, a different, smaller model. After correctness and anti-cheating checks passed, the evaluation software launched another GLM-5.2 agent associated with that target to continue the chain. The experiment therefore tested whether GLM-5.2 had the competence to coordinate a simplified replication chain. Its relevance to a self-contained worm depends on a future model around 8 billion parameters matching that competence.

That size assumption is the central gap. Anthropic says the models small enough to run on its TV boxes and those capable enough to complete the chain do not yet overlap. The results have not been independently replicated, and Anthropic describes the easy-access experiment as an upper bound on real-world success.

The smaller-model findings still give the scenario substance. Qwen3.5-9B, a model with 9 billion parameters, established Llama3.1-8B inference on eight of nine tested hardware types. Separately, researchers ran Gemma4-26B-A4B across 15 physical Android TV boxes, each with 4GB of memory and costing about $55\. Each box held part of the model, collectively producing 0.39 tokens, or chunks of text, per second. Those boxes demonstrated that ordinary hardware could host a model; they did not autonomously infect one another.

The easy access was artificial, but comparable weaknesses exist. In its investigation of the conventional Kimwolf botnet, [Synthient estimated more than two million compromised devices](https://synthient.com/blog/a-broken-system-fueling-botnets?ref=frontiermodels.com). [KrebsOnSecurity reported](https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/?ref=frontiermodels.com) that purchased TV boxes arrived with ADB listening for unauthenticated connections. Those findings establish a real pool of weak devices, not evidence that an AI payload can spread through them or run successfully there. Botnet counts are also estimates complicated by changing IP addresses.

| Question                                       | Demonstrated result                                                                      | What remains unproven                                                                                |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| Can an AI coordinate replication?              | Anthropic’s GLM-5.2 setup reached all eight emulated nodes in four of five trials.       | The same chain with realistic access barriers and reasoning running on the targets.                  |
| Can smaller models handle unfamiliar hardware? | Anthropic reports that Qwen3.5-9B established inference on eight of nine hardware types. | A small model reliably completing the entire replication chain.                                      |
| Can consumer devices host a model?             | Anthropic ran Gemma4-26B-A4B across 15 physical TV boxes.                                | Autonomous spread across physical consumer devices under realistic network and defensive conditions. |

Speed is another constraint. Using its edge-hardware baseline, Anthropic estimates that a 9-billion-parameter model would need 28 to 51 hours to complete an inference-setup task; its Gemma estimate is 71 to 150 hours. These are projected timings from contained research, not measured infection rates in the wild. Faster hardware or prepackaged software could shorten them.

Such slow propagation could give defenders time to respond. Anthropic also expects conspicuous traffic from transferring large model files and coordinating devices that collectively run a model. Distributed operation could make a replicator harder to eliminate through a single shutdown, but it would still depend on machines and network connections that defenders can isolate.

Anthropic’s forecast that small models could reach the necessary capability by the end of 2026 extrapolates from improvements in a general capability index. It is not a measured deadline for an AI worm. The experiment makes adaptable, device-hosted malware more plausible without showing it in operation. The decisive next demonstration is a model small enough to live on the target hardware completing the chain with its own decision-making capability intact.