Anthropic’s Frontier Red Team publishes two kinds of work, and only one kind holds up to scrutiny. Its self-replication report rests on a projection that small models and cheap consumer hardware converge “by the end of this year,” while conceding the capability floor and hardware ceiling “do not intersect yet.” The demo behind it sharded a 26B model across 15 off-brand Android TV boxes. The exploit evaluations are counted results instead: Claude Mythos Preview built 8 working code-execution exploits from 18 SpiderMonkey security patches. Infosec researchers have gone after the self-replication piece as regulatory capture, and the technical half of that criticism lands.
Infosec researchers spent last week calling Anthropic’s safety team clowns, on the record, in a trade publication. The Stack collected the quotes 7 days ago under a headline too profane to reproduce, and the anger is aimed at one report rather than the team’s whole output.
That report is AI models may be capable of self-replicating without access to a datacenter, published 13 days ago by a group of roughly 15 researchers who stress-test Anthropic’s models, and sometimes competitors’, for cyber, national-security and autonomy risks. Its most quoted detail is a demonstration cluster. Its own conclusion is that the trend lines making such a cluster dangerous “do not intersect yet.”
The self-replication report and its own hedge
Anthropic tested whether open-weight models could handle end-to-end replication: acquire hardware, stand up inference, copy themselves onward. Of the models tested, only GLM-5.2 and presumably anything stronger completed the full chain. A 9B model, Qwen3.5-9B, brought up inference servers on eight of nine hardware types, from a Jetson Nano up to an RTX 4090.
Then came the demo. Anthropic ran Gemma4-26B-A4B sharded across 15 off-brand Android TV boxes at roughly $55 each, and got 0.39 tokens per second out of it.
The report’s framing around that result is cautious. Small models sit below the capability floor for reliable replication, cheap consumer devices sit below the compute ceiling, and Anthropic projects the two could converge “by the end of this year.” That projection carries the report, and it is a forecast rather than a measurement.
Infosec researchers rejected the threat model
Juan Andrés Guerrero-Saade of Johns Hopkins SAIS dismissed the scenario on technical grounds: “An IoT botnet running a distributed model at sub 10-tokens per second is not representative of any realistic concern.” He went further on motive, saying “it’s obvious to those of us established in this space that ‘cyber research’ is being used as a tool for policy arguments and regulatory capture.”
Greg Linares called the scenario “weaponized misinformation” and said anyone pushing the narrative “has either no idea how real world malware works or is playing along.” ML researcher Michael Jordan attacked the broader approach as “bad engineering practices” rooted in “science-fiction dreams of the libertarian lunatics of Silicon Valley.”
The technical half of that criticism is correct, and the report leaves the hole open. A cluster generating well under one token per second has no obvious use to an attacker, and nothing in the paper explains what the replicated model would then do. One commenter on Hacker News put it plainly: “Like, ok, so you can install a low powered model on low powered hardware and do inference extremely slowly… to what end? Why would that be a useful attack at all?”
The motive half is harder to settle, and it sticks to Anthropic because the same team publishes capability assessments of competitors’ open-weight models. Worth testing that charge against the rest of the hub.
The exploit evaluations hold up
Two reports on the hub are built on counted outcomes rather than projections, and both read as more restrained than the self-replication piece.
Reverse engineering Claude’s CVE-2026-2796 exploit, from March, describes Claude Opus 4.6 working with Mozilla and finding 22 Firefox vulnerabilities over two weeks. The exploitation result is the part that cuts against alarm: the model turned a bug into a working exploit in two cases out of “hundreds of chances at dozens of bugs.” CVE-2026-2796, a JIT miscompilation in Firefox’s WebAssembly component, was one of the two.
Measuring LLMs’ impact on N-day exploits, from June, took 18 security patches to SpiderMonkey in Firefox 148 and 149 and had Claude Mythos Preview work backwards from each patch. It autonomously built 8 working code-execution exploits. The paper’s argument follows from the number: “N-day has become dangerously misleading. N-hour is closer to the reality we now operate in.” Defenders who plan patch windows in days are planning against the wrong clock, a point we covered when the exploit window collapsed.
Both results come with denominators, which is exactly what the botnet demo lacks.
Grading a competitor’s model
The fourth recent piece, GLM-5.3 and the spread of advanced cyber capabilities from 26 days ago, is the one that makes the regulatory-capture charge worth taking seriously, since it is a frontier lab publishing exploit benchmarks for a rival’s open-weight release. On Anthropic’s internal Chrome V8 benchmark, GLM-5.3 built working exploits 12% of the time against 14% for Claude Mythos Preview, with Claude Opus 4.6, GLM-5.2, Kimi K3 and DeepSeek V4.1-Flash at or near zero. Anthropic reports GLM-5.3’s safeguards fall to simple techniques, false cover stories, prefilled reasoning and abliteration, “between 64% and 100% of the time,” where the same techniques fail against Claude. We wrote that one up in detail.
The report also carries a figure that deflates its own urgency. Anthropic cites NIST’s CAISI assessing GLM-5.3 as lagging the US frontier by about four months on aggregate cyber benchmarks, which places the model on a known trend line rather than at a break in it. That wording reaches us through secondary coverage rather than a primary CAISI document, so treat the four-month number as plausible and unconfirmed. A lab warning about a capability it measures as months behind its own, on benchmarks it designed, is going to get read as marketing by part of its audience however the numbers come out.
The hub is still worth a bookmark. Start with the papers that have denominators.
Sources: Frontier Red Team • AI models may be capable of self-replicating without access to a datacenter • Measuring LLMs’ impact on N-day exploits • Reverse engineering Claude’s CVE-2026-2796 exploit • GLM-5.3 and the spread of advanced cyber capabilities
Coverage: Anthropic’s Red Team enrages infosec (The Stack) • Hacker News discussion
Related on this blog: GLM-5.3’s Exploit Safeguards Fail 64% to 100% of the Time • OpenAI Pulls Frontier Training Off the Live Internet • [AUTO] The Exploit Window Collapsed