Anthropic says its Frontier Red Team got GLM-5.2 to carry out an end-to-end replication sequence across a closed, eight-node Android emulator network. The model reached all eight nodes in four of five trials and seven in the fifth, but the test used an unauthenticated debugging port rather than a real-world break-in.
Illustrative Android TV box, not equipment used in Anthropic’s experiment. Photo: Tzah, CC BY-SA 4.0, via Wikimedia Commons.
In a report published Oct. 12, the company described a firewalled Google Cloud network of eight redroid nodes, which emulate Android 15. The test agent had to find reachable nodes, transfer its payload and set up inference, the process of having a model generate responses. Successful nodes started a Llama 3.1 8B server before the test launched another copy of the agent.
Open ADB simplified the test; TV boxes only pooled inference
The researchers deliberately made the access step easy: the nodes exposed an unauthenticated Android Debug Bridge (ADB) port, a developer interface that lets computers control Android devices. Anthropic says this makes the result an upper bound on real-world success. The experiment did not test an agent finding and exploiting a vulnerability or breaking into a consumer network.
When a node passed the inference checks, the test launched another copy of the GLM-5.2 agent for the next hop. The emulators could not run GLM-5.2, so its inference stayed on a separate server; each node served Llama 3.1 8B. Anthropic treats this as evidence that GLM-5.2 can carry out the steps a sufficiently capable smaller model would need to spread, not as a demonstration of GLM-5.2 running locally on every compromised device.
In a separate hardware demonstration, the researchers split Gemma 4 26B A4B across 15 low-cost Android TV boxes. Each box held part of the model, and the group produced about 0.39 tokens per second. That shows small devices can pool memory to run inference slowly, not that the boxes can autonomously spread to other devices.
The report identifies a narrow capability signal: a model completed repeated setup in a permissive, contained network. Anthropic’s broader forecast that smaller models may eventually pair that skill with device-level computing is an estimate, not an observed event. The team points to stronger default security and network monitoring as defenses against both AI-assisted and conventional botnets.