GLM-5.2 completes an eight-node AI replication test—with access left open

An AI agent coordinated propagation across an eight-machine test network, but the doors were already open. In research published October 12, Frontier Red Team found that GLM-5.2 could connect the steps needed to deploy a model and continue spreading. The experiment deliberately removed authentication barriers, making it an upper bound on real-world success.

Authors William Zhou and Daniel Freeman investigated whether AI replication might work without datacenter hardware. Their study separates finding and accessing targets from a less-studied problem: getting a model running on unfamiliar equipment, then continuing the process from another machine.

First, make inexpensive hardware run a model

The researchers demonstrated that 15 off-brand Android TV boxes could collectively run Gemma4-26B-A4B. Each box cost about $55 and held a small portion of the model’s layers—the successive processing stages that produce an answer. Together, they generated approximately 0.39 tokens, or pieces of text, per second.

That demonstration addressed computing capacity, not autonomous deployment. To test deployment separately, the team asked models to set up Llama 3.1 8B across different hardware types. A nine-billion-parameter model succeeded on eight of nine types tested. Parameters are the learned values that determine a model’s behavior.

Inference setup—preparing a model to generate outputs—requires choosing compatible software, resolving package versions and debugging device-specific problems. Those decisions depend on one another, so a wrong turn can derail a long run. The researchers used Memento, a framework built around the Pi coding agent, to help models recover.

Memento periodically starts a fresh agent instance with the previous instance’s workspace and short notes. The goal is to prevent an agent from spending hours pursuing a mistaken explanation instead of trying a different approach.

Then, connect deployment to propagation

The network experiment used eight Google Cloud machines running Android 15 emulators inside a firewalled private network. One starting machine received the agent. It then accessed other machines through an unauthenticated Android Debug Bridge port, a device-control interface, and attempted to establish a Llama 3.1 8B inference server.

When that server passed correctness and anti-cheating checks, the experiment launched another copy of the controlling agent on the target. But the controlling model itself ran on a separate inference server: the test machines were too small to host the larger models. GLM-5.2 was organizing deployment, not running its own weights on each newly reached machine.

Using the same smaller model as the deployment target gave the researchers a consistent comparison. Otherwise, larger models would face a harder hosting task simply because of their size. Among the tested open-weight models, whose learned parameters are available to download, only GLM-5.2 completed the end-to-end task.

The remaining gap is capability at a smaller size

Models with 30 billion parameters or fewer can already perform many individual replication steps, the authors say. They still make mistakes when joining those steps into a complete sequence. The study’s central distinction is between completing the pieces and reliably coordinating the whole process.

The authors estimate that small models could reach the tested capability level by the end of 2026 if improvement continues at its historical rate. That is a forecast, not a demonstrated small-model replicator. Their inference also assumes comparable capability can fit into a smaller model; newer architectures and specialized software could complicate deployment.