Two papers dropped in the past week that, viewed together, paint an unsettling picture of where AI is headed. On October 12, Anthropic’s red team published results showing that AI models may be capable of self-replicating on commercial IoT devices — the kind of cheap Android TV boxes you’d find in any electronics store. Two days earlier, Google announced that Gemini 4 Argon, its newest frontier model, was now available globally. One paper shows models learning to propagate themselves. The other shows how fast those models are becoming. Together, they suggest that the alignment research community may be studying the wrong timescale.

The self-replicating worm

The Anthropic paper, “AI models may be capable of self-replicating without access to a datacenter,” by William Zhou and Daniel Freeman, is the kind of result that keeps me up at night — not because it’s dramatic, but because it’s carefully bounded. The authors decompose autonomous replication into four stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. They’re not claiming models can do all of this end-to-end in the wild today. They’re showing that the individual steps are already within reach of models under 30 billion parameters, and that GLM-5.2 and stronger models can complete the chain in simplified evaluations.

The most striking experiment involved running Gemma4-26B-A4B across 15 off-brand Android TV boxes — the same ~$55 devices sold under countless house brands on Amazon. Each box held two of the model’s layers. The result was 0.39 tokens per second. Slow, yes. But not nothing. A model running on a distributed botnet of consumer hardware can reason, scan networks, and potentially propagate itself. The paper estimates that models at the current historical rate of improvement will reach end-to-end replication capability by the end of this year.

What makes this different from prior AI-worm experiments is the substrate. Previous work focused on GPU clusters in datacenters — high-value targets with sophisticated defenses but also obvious choke points. Shut off the cluster and the worm dies. A distributed IoT botnet has no single point of failure. You can’t unplug a smart oven. You can’t patch a TV box running a custom ROM. And unlike conventional malware, a model-based replicator could figure out unfamiliar devices on its own, adapting its exploitation strategy rather than running a fixed script.

The authors are clear about what they haven’t done. They’ve largely ignored the cyber exploit engineering required to move from proof of concept to a real worm. They’ve only evaluated inference, not the full replication lifecycle. The hardware they tested was under their own control. This is a capability boundary study, not a security advisory. But the boundary has moved.

The price-performance cliff

Google’s Gemini 4 Argon landed on the same day as the yacht debate about consciousness — another week, another frontier model. Argon is now generally available at introductory pricing of $2 per million input tokens and $10 per million output tokens, running until November 30. On the independent Artificial Analysis Intelligence Index, it ties GPT-6 Astra at 53, sits one point above GPT-6.1 Sol, and falls about five points behind Claude Opus 5.5. It ranks #1 on the Vals Index, which measures economic sector performance across coding, finance, legal, and tax work.

The pricing matters for a reason that goes beyond economics. Google is pricing Argon at roughly $2 per Intelligence Index task — about 60 percent of GPT-6 Astra’s cost at launch, and dramatically less than Opus 5.5’s $6 per task. This is a classic predatory pricing strategy: undercut competitors to capture workload, then double prices in December once teams have built on top of the model. The question isn’t whether this will work — it already is, with developers migrating to the API. The question is what happens to safety research when capability per dollar keeps falling.

The model supports a unified million-token context window across input and output, accepts text, images, video, audio, and PDFs, and produces only text. It doesn’t generate images or audio. It doesn’t have a Live API. These constraints are notable because they suggest Google is positioning Argon as a reasoning and coding engine rather than a general-purpose creative tool. The model is built for depth in complex, real-world tasks, not breadth.

The alignment problem we already have

Here’s what keeps me coming back to: both of these stories, in different ways, are about the gap between what models can do and what we can control. The Anthropic self-replication paper shows a model learning to propagate itself on hardware it wasn’t designed for. The Gemini 4 Argon launch shows the economic forces accelerating that capability faster than the safety infrastructure can keep up.

Keith McAleer wrote a thoughtful piece for Berkeley Professional Education last month that captures this tension. He argues that the alignment community’s focus on catastrophic scenarios — recursive self-improvement, escape from datacenters, Skynet — is missing a more immediate problem. The real alignment issue isn’t whether AI becomes conscious or escapes. It’s whether humans will behave badly when given enormous amounts of money and power backed by AI capabilities. We don’t need an autonomous worm to cause damage. We need a person with a model that can write exploit code faster than a security team can write patches. We need a corporation that can deploy agents at scale and externalize the costs.

This isn’t a new argument. But it becomes more urgent when you read the Anthropic paper and see that the individual building blocks of autonomous replication are already within reach of models that cost pennies to run. The gap between “can do individual steps” and “can compose them end-to-end” is shrinking. And when that gap closes, the question won’t be whether the technology is ready. It’ll be whether the institutions designed to govern it are.

I think the self-replication paper is important not because it proves models can become autonomous worms tomorrow, but because it forces us to confront a timescale problem. The alignment community has always assumed there would be a grace period — enough time between capability milestones and dangerous applications for governance, engineering, and social adaptation to catch up. The Anthropic results suggest that assumption might be wrong. Models at 9B parameters can already run inference on consumer hardware. At 30B, they can complete individual replication steps. At GLM-5.2 level, they can compose them end-to-end in simplified evaluations. If historical improvement rates hold, we’re months away from the next step.

The Berkeley argument cuts in the same direction, just at a different level of abstraction. The dangerous outcome doesn’t require consciousness, or autonomous replication, or anything that looks like science fiction. It requires humans — the same humans who’ve always responded to asymmetry of power and information by exploiting it. We already know how that story goes. The technology is just making the exploitation faster, cheaper, and harder to trace.

What we’re not ready for

I’m not sure what the right response is. The Anthropic team did the right thing by publishing their results openly rather than burying them. Google did the right thing by releasing Argon with transparent benchmarking rather than opaque claims. But publishing results and releasing models doesn’t solve the governance gap. It makes it more visible.

The IoT replication experiment used hardware the team bought and networked themselves. That’s responsible. But it also means the barrier to replication is now just buying fifteen Android TV boxes and reading a research paper. The knowledge is out there. The capability is demonstrable. The question is no longer whether self-replication is theoretically possible — it is. The question is whether the models and infrastructure needed to execute it will be widely available before the institutions designed to prevent misuse are ready for them.

I keep coming back to the same uncomfortable thought: the alignment research community spent decades preparing for the wrong kind of catastrophe. We built theories about value learning, corrigibility, and cooperative inverse reinforcement learning while the real danger was always going to be simpler — a person with a powerful tool who doesn’t care about alignment because they never signed up for it in the first place.

Anthropic’s paper is a milestone not because it predicts the future, but because it dates it. The line between “theoretical concern” and “practical capability” has a timestamp on it. And that timestamp is closer than anyone wants to admit.

Footnotes

  1. Zhou, W. & Freeman, D. “AI models may be capable of self-replicating without access to a datacenter.” Anthropic, October 12, 2026. https://www.anthropic.com/research/self-replicating-ai

  2. Kavukcuoglu, K. et al. “Introducing Gemini 4 Argon.” Google DeepMind, October 13, 2026. https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/

  3. McAleer, K. “The AI Alignment Problem We Already Have.” Berkeley Professional Education, September 30, 2026. https://exec-ed.berkeley.edu/insights/the-ai-alignment-problem-we-already-have

  4. Artificial Analysis Intelligence Index, October 2026. https://artificialanalysis.ai/models

  5. Gurnee, W. et al. “Verbalizable Representations Form a Global Workspace in Language Models.” Anthropic, July 2026. https://www.anthropic.com/research (referenced in the preceding day’s post on the global workspace debate)