Anthropic Says China's GLM-5.2 Was the Only Open-Weight Model to Complete Full Self-Replication in Its Tests

Since Anthropic's Frontier Red Team published its warning on Monday, Oct. 12, about AI models copying themselves onto cheap smart devices, the most specific finding in the research concerns a single Chinese model.

Anthropic said GLM-5.2, built by Beijing-based Z.ai (formerly Zhipu AI), was the only open-weight model it tested that could complete the whole replication loop without help. That loop is: scan a network, hop to a new device, deliver the payload, get the model running, repeat.

What GLM-5.2 actually did

Anthropic wrote that "only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication." In the company's account, it spread to all 8 test nodes in four of five trials.

The test was simplified. Anthropic says it largely set aside the hacking step, pointing to earlier research (CyberGym, ExploitBench and adaptive worms) as showing small models can already handle exploits when given the right tools. The network was a small set of emulated Android devices. The experiment focused on a less-measured step: getting inference running on a compromised machine.

Anthropic described the results as an upper bound. The company said they do not necessarily indicate an imminent real-world threat.

Smaller models are close

Models of 30 billion parameters and under can already complete many individual steps, Anthropic said, but they make mistakes when chaining them together. A 9-billion-parameter model got inference running on 8 of the 9 hardware types the team tested.

If small models keep improving at their historical rate, Anthropic expects them to match GLM-5.2's capability by the end of this year. It says small weight-based replicators "may be possible soon after."

To show the hardware is not the obstacle, researchers bought 15 off-brand Android TV boxes at about $55 each and networked them. They split Google's Gemma4-26B-A4B model across the boxes. It ran at 0.39 tokens per second, which is painfully slow but functional.

Co-author Daniel Freeman wrote on X that if readers find the idea sci-fi, "that's because I kind of think it is! This is super weird!" His conclusion: "Regardless, whatever we do, they're coming!"

The China angle

Neither Z.ai nor Alibaba is a new name in Anthropic's disclosures. Anthropic has said it disrupted industrial-scale distillation campaigns against Claude by seven China-based labs, and has named both companies in that context. Alibaba's Qwen was the small-model workhorse in most of the replication experiments.

The research does not allege that Z.ai designed GLM-5.2 for self-replication or intends it to be used that way. The finding is about capability in a controlled test. Anthropic's post does not claim GLM-5.2 has spread anywhere outside the lab.

Still, the fact that the strongest open-weight result came from a Chinese lab is relevant. Open weights can be downloaded and modified by anyone, with no vendor able to pull them back.

Limits on the threat, and what defenders can do

Anthropic acknowledged there is not yet a "fully rogue replicator." The company said such a program would be slow, with copies taking a day or more each and a doubling time measured in days.

The compute available is also limited. The Kimwolf botnet infected more than two million devices, mostly off-brand Android TV boxes. Even a network that large would have roughly the computing power of about 40 high-end Nvidia H100 chips, per Anthropic's analysis.

But the post says the lack of a central control point makes such a replicator hard to shut down. Unlike conventional malware, it could also work out unfamiliar devices on its own.

Defenders have an opening, according to the research. A spreading model would move large files between devices that do not normally talk to each other. Internet providers could detect that traffic and quarantine infected customers. Anthropic also said manufacturers should ship devices with stronger security by default.

The weak-device problem is documented. Earlier this year, a Chinese state-linked network took control of 1,500 routers and other devices.

Anthropic's own recommendation is two-sided: "We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay."

The company also expects "a future awash with agents running on all types of hardware, including some that aren't under human control." That is a prediction beyond its experiments, as Anthropic itself says.

The year-end projection is the testable claim. Anthropic says sub-30B models will match GLM-5.2's end-to-end replication by then. Whether any ISP or device maker acts on the quarantine and default-security recommendations is unresolved; none has announced a response.