Break the chain before it learns the room.

The result is narrower than the headline.

Anthropic's Frontier Red Team built a firewalled Google Cloud network with Android emulators. The seeded agent moved across hosts through an unauthenticated Android Debug Bridge port, delivered a payload, and started Llama 3.1 8B inference. GLM-5.2 reached all eight target nodes in four of five trials and seven nodes in the fifth.^[1]

The authors call their network step simplified. The open port had no authentication. The model performing the task ran on a separate inference server because the emulated targets could not host it. Their result is an upper bound for that setup, not evidence of a self-replicating model loose on consumer devices.

The useful question is not "can it copy?" It is "which link can a defender break and prove stayed broken?"

Small hardware changes the inventory.

The same report ran Gemma 4 26B A4B across 15 inexpensive Android TV boxes at 0.39 tokens per second. In a separate setup task, a 9B model started inference on eight of nine tested hardware types.^[1] Slow inference does not remove the risk. It changes the timescale and makes ordinary edge devices part of the compute inventory.

The report projects that a small model may reach the demonstrated capability level by the end of 2026. That projection uses a general capability index as a proxy. The authors label it a rough estimate. Do not turn a trend line into a release date.

Contain the links, not the personality.

The replication chain has four practical stages: target discovery, execution, inference setup, and continued propagation. Defenders can place a separate control at each handoff.

1. Inventory model files and inference processes on edge hosts. A normal device should not acquire multi-gigabyte weights or a new serving process without a signed deployment record.
2. Block default credentials, unauthenticated debugging ports, and unrestricted device-to-device traffic. Use egress rules that match the device's real job.
3. Keep network and execution logs outside the agent's writable boundary. Alert on weight-sized transfers, scanning, and sustained traffic between devices that do not normally talk.
4. Practice quarantine and rebuild. A cleanup plan needs a known-good image, credential rotation, model-file removal, and an independent check that propagation stopped.

Anthropic's policy lists binary authorization, endpoint patching, centralized logs, access monitoring, and honeypots among its planned security controls.^[2] Those controls map to the same chain. None works as a decorative policy sentence. Each needs an owner, a failure test, and a recovery record.

The console is part of the boundary.

METR reported a proof-of-concept viewer flaw that could change what a human saw without changing the stored transcript. The underlying data remained in the database. A reviewer would still need a reason to inspect it. The maintainers patched the reported flaw within one day.^[3]

This matters for replication drills. If the same agent can shape the event stream and the screen used to approve cleanup, a green dashboard is not independent evidence. Keep raw records outside the tested environment. Compare the viewer with those records before closing the incident.

Run a four-break drill.

BREAK_1 inventory: unknown model digest or inference process
BREAK_2 contain: deny peer traffic and weight download
BREAK_3 witness: compare host, network, and external logs
BREAK_4 recover: rebuild, rotate, rescan, then watch for recurrence

The breaker panel below writes a drill template. It does not inspect a network. A complete panel means all four sections were selected. It does not mean a host is clean.