Anthropic's Frontier Red Team tested "weight-based replicators". A 9B model got inference running on 8 of 9 hardware types. They ran Gemma4-26B-A4B sharded across 15 ~$55 Android TV boxes at 0.39 tokens/s. In an 8-node emulated Android fleet with unauthenticated ADB, only GLM-5.2 replicated end to end (8/8 nodes in 4 of 5 trials). Their trend line puts a small model at that level by the end of 2026. Caveats: the exploit step was trivial, replication is slow (days per hop), and no real-world worm was seen. Defender angle: multi-GB model payloads and sustained device-to-device traffic should show up in flow monitoring. Kill default credentials and exposed ADB.