YANTRAKAR Contact

FIELD NOTES · AI SAFETY

Self-replication: why the network boundary matters more now

I have built software that copies programs to a fleet of machines and starts them there. Copy and run are two of the steps a self-replicating model needs. In that work the safeguard is the process around the software: every change is tested first, and a person starts each rollout. A self-replicating model takes that person out of the loop.

Sandeep Shelke · Stavanger ·

What they measured

On 12 October, Anthropic's Frontier Red Team published research on whether AI models can copy themselves onto cheap hardware and keep running there, without a datacenter. Of the open models they tested, only GLM-5.2 completed the whole chain, and it did so in most trials. Small models are not there yet, but the researchers write that they may be months away. The test devices had no authentication on their debug port, which made the break-in step trivial, so the team treats the results as an upper bound on real-world success.

TABLEWHAT THEY MEASURED
Results from Anthropic's Frontier Red Team.
MeasuredResult
GLM-5.2, full replication8 of 8 nodes in 4 of 5 trials, 7 of 8 in the fifth
Qwen3.5-9B getting inference running8 of the 9 hardware types tested
Qwen3.5-9B getting inference running, with notes inherited from the previous generation45% in the first generation, 61 to 84% in later ones
Gemma4-26B-A4B across 15 Android TV boxes, about $55 each0.39 tokens per second
Time for one Qwen3.5-9B replication1 to 2 days
When small models reach GLM-5.2's levelBy the end of 2026, if the trend holds (on an index the authors call a rough proxy)

Source: Anthropic, AI models may be capable of self-replicating without access to a datacenter, 12 October 2026.

Slow is still usable

Fig. 01 puts the TV boxes next to my setup, running the same model. My old card writes answers about 45 times faster, though the two numbers are not measured the same way. For a replicator, slow is enough.

FIG. 01SLOW IS STILL USABLE
Fifteen TV boxes against my older card From Anthropic's research: 15 Android TV boxes at about 55 dollars each run Gemma4-26B-A4B together at 0.39 tokens per second. My own setup: an older 8 GB card runs the same Gemma4-26B-A4B at about 18 tokens per second when writing the answer, about 45 times faster. Measured differently, shown for scale. 15 Android TV boxes · about $55 each $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 0.39 tok/s Gemma4-26B-A4B across all 15 My older card · 8 GB ~18 tok/s Gemma4-26B-A4B, decode About 45 times faster Fifteen TV boxes against my older card From Anthropic's research: 15 Android TV boxes at about 55 dollars each run Gemma4-26B-A4B together at 0.39 tokens per second. My own setup: an older 8 GB card runs the same Gemma4-26B-A4B at about 18 tokens per second when writing the answer, about 45 times faster. Measured differently, shown for scale. 15 TV boxes · about $55 each $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 $55 0.39 tok/s Gemma4-26B-A4B, all 15 My older card · 8 GB ~18 tok/s Gemma4-26B-A4B, decode About 45 times faster
The same model, Gemma4-26B-A4B, on both sides. The TV boxes are from Anthropic's Frontier Red Team, the card is my own setup. Measured differently, shown for scale.

Where to break the chain

FIG. 02WHERE TO BREAK THE CHAIN
Self-replication needs four steps; block one and it stops My own breakdown: four steps a self-replicating model needs, each with what stops it. One, foothold: an agent runs with tools and keys; stopped by least privilege, only the tools the job needs and no standing keys. Two, reach: other machines are reachable; stopped by a segmented network, model servers on their own subnet with no open egress. Three, copy: the model files move to a new host; stopped by watching transfers, alerts on multi-gigabyte model files moving between hosts. Four, run and stay: the copy starts and stays running; stopped when a person starts every rollout and nothing else is allowed to run. What it needs What stops it 1 Foothold an agent runs with tools and keys 2 Reach other machines are reachable 3 Copy the model files move to a new host 4 Run and stay the copy starts and stays running Least privilege only the tools the job needs, no standing keys Segmented network model servers on their own subnet, no open egress Watch transfers alert on multi-GB model files moving between hosts A person starts every rollout nothing else is allowed to run Self-replication needs four steps; block one and it stops My own breakdown: four steps a self-replicating model needs, each with what stops it. One, foothold: an agent runs with tools and keys; stopped by least privilege, only the tools the job needs and no standing keys. Two, reach: other machines are reachable; stopped by a segmented network, model servers on their own subnet with no open egress. Three, copy: the model files move to a new host; stopped by watching transfers, alerts on multi-gigabyte model files moving between hosts. Four, run and stay: the copy starts and stays running; stopped when a person starts every rollout and nothing else is allowed to run. Each step, and what stops it 1 Foothold an agent runs with tools and keys Least privilege only the tools the job needs, no standing keys 2 Reach other machines are reachable Segmented network model servers on their own subnet, no open egress 3 Copy model files move to a new host Watch transfers alert on multi-GB model files moving between hosts 4 Run and stay the copy starts and stays running A person starts every rollout nothing else is allowed to run
My own breakdown of the steps a self-replicating model needs, and the control that stops each one. Blocking any one step is enough.

This is why I see private AI and safety as one piece of work. The controls in Fig. 02 that keep your code from leaving also keep a model from spreading. The defences Anthropic proposes sit further out, with internet providers and device makers: network monitoring, honeypots, quarantine of infected devices, and safer defaults. Their aim is to push the replication rate below one, so that an outbreak dies out instead of spreading.

What I would do

If you run models inside your network, this is what I would add:

  1. Give agents only the tools their job needs, with no standing keys.
  2. Keep model servers on their own network segment, and have a person start anything that copies or runs models on other machines.
  3. Alert when multi-GB model files move between hosts.

The hardware, the models and where I would start are in Running AI inside your own network: what I see so far.

This is the work I do at Yantrakar. Some clients want consulting hours and some want an end-to-end service, and I price the work on what it needs. To talk about your setup, use the contact form or find me on LinkedIn. More on how I work is on the Private AI page.

Contact

Tell me which data and which work you have in mind.

Stavanger, Norway

Remote across EU and India time zones, on-site when needed

I read every message myself and reply within 24 hours. Your details are used only to reply to this message.