Anthropic: open models months from self-replicating on $55 boxes
A 9B model ran on 8 of 9 device types; GLM-5.2 replicated across 8 nodes. The harness trick and edge-inference numbers are the real builder takeaways.
Copy markdown
A 26B model, 15 TV boxes, $825 total
Anthropic's Frontier Red Team ran Gemma4-26B-A4B distributed across 15 off-brand Android TV boxes — $55 each, ~$825 — at 0.39 tok/s, and got a 9B model inferencing on 8 of 9 hardware types from Jetson Nanos to RTX 4090s. Cheap consumer silicon is now a real inference fabric, and a real attack surface.
GLM-5.2 is the replication threshold — and it's close
In simplified tests GLM-5.2 completed end-to-end self-replication (8/8 nodes in 4 of 5 trials); smaller open models failed reliably. Anthropic projects sub-30B models reach that bar by end of 2026, tracking ~13.7 Epoch Capability points/year (R²=0.95) — worth planning containment around now, not later.
Steal this: the Memento harness
Memento periodically kills the agent and spins up a fresh instance carrying only the workspace plus short notes, so it stops fixating on dead ends. Across six generations of Qwen3.5-9B, setup success climbed from 45% to 61–84%. For long-horizon agents, fresh-instance-plus-notes beat one ballooning context.
Edge inference just cleared the bar: 226 tok/s on a Thor
A Jetson AGX Orin 64GB ran Qwen3-30B-A3B at 76.7 tok/s; an AGX Thor hit 226 tok/s. If you assumed serious local agents still need a datacenter GPU, edge accelerators now handle real workloads — useful for on-device and air-gapped builds.
Containment: flag multi-GB transfers, kill open ADB
Defenses that work: watch for anomalous device-to-device traffic and multi-gigabyte model transfers, strip default credentials, and close unauthenticated ports (the test network used open ADB). Mirai precedent — ISP quarantine with notification cleared 92% of infections within 14 days.