By Dr. Jasmin Cowin
The final frontier, it turns out, is an off-brand Android TV box, and the crew that boldly went there was a 26-billion-parameter model, through autonomous replication and adaptation (ARA) courtesy of Anthropic’s lab. On October 12, 2026, Anthropic’s Frontier Red Team, William Zhou and Daniel Freeman, published “AI models may be capable of self-replicating without access to a datacenter.” [1]. The authors ran a 26B-parameter open-weight model across fifteen off-brand Android TV boxes bought for roughly $55 each. A 9B model stood up inference on eight of nine hardware types tested. Models under 30B parameters already complete most individual steps of replication; GLM-5.2 completed the full cycle in a contained fleet, and the authors project that small models will reach that level by the end of 2026 if historical improvement rates hold [1]. In my opinion, our collective concern should focus on ARA, a model propagating itself beyond human control. The Anthropic Frontier Team compares it to a computer worm that carries its own weights as the payload and runs inference on whatever hardware it has compromised
The International AI Safety Report 2026 explains that deep learning models acquire their capabilities by adjusting numerical values known as weights during training. Once a model’s weights are publicly available, others can download and operate it without relying on its original developer. The report states: ‘Once released, model weights cannot be recalled.’ While the scenario remains prospective, Anthropic’s self-replicating AI could carry those weights as it moves between compromised devices, or download them again, and set up the model on whatever hardware it encounters. [1, 4] Anthropic estimates that a plausible small-model replicator could spread exponentially like a computer worm, with the number of copies doubling every few days – each new copy helping to establish additional copies. Once a worm is dispersed among privately owned devices, there is no single switch that turns off a decentralized infestation.
I have a personal interest in this finding. I do not connect my household appliances to the Internet of Things, partly because of what I have long called my paranoid fear that my house might experience a hostile takeover. After reading the study, I am less inclined to use the word paranoid. The vulnerability that concerns me extends beyond my own devices. I cannot choose the security standards of the televisions in neighboring homes or the conditions under which they connect to a shared network.
I locate the prospective threat principally in the Loss of control band of my ‘Substrate to Singularity’ taxonomy of AI risk, published in my Horasis analysis of autonomy and resistance to oversight. The diagram places that band above Embodied and agentic systems and, further below, the Planetary and structural substrate. The Anthropic experiment is grounded in those lower conditions: agents that can undertake sequences of tasks and inexpensive hardware on which computing can occur outside centralized data centers. Autonomous replication raises a distinct concern about whether people and institutions could retain effective oversight once copies were dispersed. [1,3]
Figure 1. Substrate to Singularity: A Vertical Taxonomy of AI Risk. Cowin (2026).
Anthropic has not demonstrated deceptive alignment, scheming, resistance to shutdown, or recursive improvement in intelligence. However, its experiments provide evidence about individual capabilities and an uncontained replication sequence. Another test found that a small model performed better at setting up inference when successive attempts inherited notes about earlier failures. That suggests a possible route to adaptation while not establishing an autonomous system learning as it spreads through actual households. [1,3]
Seth Lazar’s essay “Anticipatory AI Ethics,” [2] written for the Knight First Amendment Institute, offers a way to think about a harm that has so far been demonstrated only in a contained fleet. He defines anticipatory ethics as identifying the ethical issues raised by emerging technologies before deployment, with the intention of shaping those technologies to serve humanity. He documents two objections. The moral objection is that conditioning on claims about powerful future AI lends credibility to the companies with the greatest financial interest in those claims and therefore diverts attention from present harms. The epistemic objection is that such work tends toward technological determinism and toward predictions that fail, because the future is a complex unknown.
Lazar's answer is to confine the work to what he calls the 'technological horizon,' the range of futures that plausible extensions of current systems could produce when deployed into institutions held roughly constant [2]. Within that horizon, he asks ethicists to give up predicting how society as a whole will turn out under AI and to focus on a narrower claim: if a system acquires a particular capability, and if it is deployed into the IoT we have now, then a specific harm becomes more likely. I interpret humility, in his usage, as belonging to the first half of that claim, because whether the capability exists is a question that can be tested, and the Frontier Red Team has now tested it. Decisive action belongs to the second half, because the measures that would reduce the harm can be put in place while the testing is still underway.
The Anthropic case shows two audiences. Inside companies, anticipation concerns capability, meaning what can be tested in a model and withheld from release. The general threat of autonomous replication had been under evaluation there since 2023, as the study's citations confirm [1]. In public life, anticipation focuses on what institutions are willing to absorb and what citizens are required to accept. Laboratory experiments can investigate capabilities, publish results, and evaluate the models within their reach, yet authority ends well before the reality of public consequences regarding uncontrolled self-replication. Such decisions and regulations belong to governments, regulators, and infrastructure operators, and the questions they face are of a different kind: how much risk the public will tolerate from devices already in their homes; who pays when a television becomes a worm node; is such a risk insurable; and whether a company's voluntary publication is an acceptable substitute for a reporting duty.
Or perhaps we should submit to the fuller sense of humility, the one that asks us to accept a world in which some computation is permanently feral?
References
[1] Zhou, W., & Freeman, D. (2026, October 12). AI models may be capable of self-replicating without access to a datacenter. Anthropic Frontier Red Team. https://www.anthropic.com/research/self-replicating-ai
[2] Lazar, S. (2025). Anticipatory AI ethics: Steering AI ethics towards the technological horizon. Knight First Amendment Institute at Columbia University. https://knightcolumbia.org/content/anticipatory-ai-ethics
[3] Cowin, J. (2026, October 1). Capabilities, behaviors and resistance to oversight: How much autonomy have we already given AI? Horasis. https://horasis.org/capabilities-behaviors-and-resistance-to-oversight-how-much-autonomy-have-we-already-given-ai/
[4] International AI Safety Report. (2026). International AI Safety Report 2026. https://internationalaisafetyreport.org/publication/international-ai-safety-report-2026
Dr. Jasmin (Bey) Cowin is an associate professor at Touro University, where she held the CETL Faculty Fellowship for 2024–2025. A Fulbright Scholar and SIT graduate, she was selected as a U.S. Department of State English Language Specialist in 2024. She served as a Richard P. Nathan Public Policy Fellow at the Rockefeller Institute of Government and as an education policy fellow (EPFP™) at Columbia University, Teachers College. She is the Senior Advisor on AI Policy, Governance, and Educational Innovation at Université Lumière de Bujumbura. Connect with her on LinkedIn.
