Anthropic Safety Experiment: GLM-5.2 Can Autonomously Replicate to Isolated Network Devices

This study was conducted by two Anthropic researchers, William Zhou and Daniel Freeman, on the topic of Autonomous Replication and Adaptation (ARA). The experimental setup is not complicated: let GLM-5.2 attempt to autonomously spread an 8-billion-parameter AI model across 8 devices in an isolated network.

The result: in 5 tests, GLM-5.2 captured and deployed to all 8 devices 4 times, and took 7 devices in the remaining test. According to the source's summary, complete AI self-replication generally requires four steps: finding targets, obtaining execution permissions, configuring the inference environment, and continuing to spread outward.

But the boundaries must be made clear. The end-to-end test was a network of 8 GCP nodes set up in an isolated sandbox, with nodes running redroid emulators based on Android 15; node 0 was implanted with the initial worm, after which the AI autonomously scanned and penetrated adjacent nodes through unauthorized ADB ports. In other words, the starting point was human-provided; only the spread process was completed autonomously by the AI. This is not a real internet environment.

Another easily overlooked detail: although other smaller open-source models can complete individual steps, they still frequently collapse when chaining long sequences together. GLM-5.2's clear run is therefore more a demonstration of a capability ceiling than the general level of current open-source small models.

Among the four steps of self-replication, the first two—finding targets and exploiting vulnerabilities—have long ceased to be bottlenecks. The source notes that security benchmarks such as CyberGym and ExploitBench have repeatedly proven AI's ability to write penetration scripts. What truly stalls automated programs is the third step: how the AI can set up the inference environment by itself on completely unfamiliar hardware and operating systems.

The researchers' cross-hardware test provides a reference point. They used Qwen3.5-9B as the executor to deploy Llama3.1-8B onto devices including Jetson Nano, Mac PC, and RTX 4090; on 8 of 9 hardware types, the model autonomously read error logs, wrote scripts to install dependencies, and successfully brought up the inference service.

It must be distinguished that this is a different experiment from the GLM-5.2 end-to-end test: the executor is Qwen3.5-9B, the target is Llama3.1-8B, and what is examined is cross-hardware deployment rather than the complete replication chain. Conflating the two would overestimate the strength of the conclusions from a single experiment.

From an engineering perspective, this step is difficult because it requires the model to continuously trial-and-error in an unfamiliar environment lacking prior knowledge—issues like Python versions, driver matching, and dependency conflicts that human programmers often struggle with for hours. The source does not disclose the specific distribution of these failure cases, so the cost behind "8/9 success" remains opaque.