Anthropic's self-replication test: 0.39 tokens per second on real TV boxes, 4 of 5 runs on emulated ones

0.39 tokens per second on real boxes, 4 of 5 runs on emulated ones

Anthropic's Frontier Red Team says small AI models may be months away from copying themselves across cheap internet-connected devices. The figure on its page that comes from real TV boxes is a speed. A 26-billion-parameter open-weight model, split across 15 off-brand Android TV boxes bought for about 55 dollars each, answered at 0.39 tokens per second. That is about 33,700 tokens a day, and a 1,000-token step at that rate takes about 43 minutes (both derived).

The figure that travelled in the headlines, four runs of five, comes from a different experiment on different machines. Eight emulated Android devices sat in a firewalled cloud network. The hacking step was made trivial on purpose. The replicating agent's own model ran on a separate server, and what the agent set up on each device was a smaller 8-billion-parameter model, not itself. Of four open-weight models tried, one completed the task. Anthropic itself calls the result an upper bound on real-world success.

This briefing reads Anthropic's own page (published 12 October 2026 by two Frontier Red Team researchers), including the data embedded in its interactive figures, and checks SecurityWeek's report and The Register's critique, both of 13 October, against it. All three were read in full between 19:54 and 20:19 BST on Tuesday 13 October 2026. Anthropic sells access to closed-weight Claude models and competes with the makers of the open-weight models it tested; the recommendations on its page are aimed at ISPs and device makers. This briefing gives no prompts, configuration or exploit steps.

What the record does not establish: that any AI worm exists (the page says there is no full rogue replicator yet); that any model has copied itself onto a real device; that the models can compromise real devices without the trivial step; how fast one would spread in the real world; that the year-end date holds; that anyone outside Anthropic has reproduced the results; or which policy response is right. The sections below set out the checkable parts, the arithmetic, the two sides of the argument and the UK controls.

SecurityWeek against Anthropic's page: where they differ

SecurityWeek's report is accurate on most counts. The table sets each of its figures against the page it links and records the differences. Where the report and the page differ, this briefing follows the page.

SecurityWeek (13 October 2026) checked against Anthropic's page (12 October 2026). Figures marked derived are this briefing's arithmetic; figures from interactive charts were read from the data embedded in the page.

SecurityWeek says	Anthropic's page says	Difference
15 off-brand Android TV boxes, about 55 dollars each	15 inexpensive off-brand Android TV boxes, about 55 dollars each, bought and networked, with 4 GB of memory each	None.
A 26-billion-parameter model split across them ran at 0.39 tokens per second	Same figure. Elsewhere it gives about 0.3 tokens per second, averaged over prefill and decode in its set-up workload, and says speed falls as context grows	One speed reported. The page gives two, for different workloads.
A 9-billion-parameter model got inference running on 8 of 9 hardware types	Same. Its figure shows 7 of the 9 types are cloud instances and 2 are physical bench boards. The model's set-up runs ranged from 0 of 4 to 13 of 15 successes per type	The report does not say most types are cloud instances (read from the figure data).
Full cycle tested on a closed network of 8 emulated Android devices, with the hacking step trivial	Same: 8 cloud nodes running an Android emulator, no authentication on the debug port. The agent's model ran on a separate server, and the item set up was an 8-billion-parameter model	The report omits the separate server and what was set up.
Only GLM-5.2 completed it, reaching all eight devices in four of five runs	8 of 8 nodes in 4 of 5 trials and 7 of 8 in the other. Its figure lists four models; the other three had no serving node in any run (5, 6 and 5 runs). The figure labels GLM-5.2 as 744 billion parameters	The report omits the fifth run, the other models' run counts and GLM-5.2's size.
An upper bound for real-world success, but Mirai spread by default credentials	Same, and adds that real IoT security might not be dramatically harder than the trivial step	None. The second half is Anthropic's argument.
Models of 30B or fewer can do many steps but fail at chaining; Anthropic expects them to reach GLM-5.2's level by the end of 2026	Same, from a trend in a general capability index that the page calls only a proxy and a rough estimate	The report drops the proxy and rough-estimate wording.
About 133,000 copies on a Kimwolf-sized botnet, at most about 40 H100s of compute, each replication more than a day	Same copies and compute figure. Full set-up takes 28 to 51 hours for the 9-billion model and 71 to 150 hours for the 26-billion model	More than a day fits the smaller model. For the 26-billion copies the page's figure is 3 to 6 days (derived).
Large transfers and sustained traffic between devices that do not normally talk would stand out in ISP monitoring	Same expectation. No test is described, and the page says it has not tested a replicator that counters defenders	The report relays an expectation, not a result.
There is no full rogue replicator yet	Same	None.

One headline, four stages, three experiments

The page splits replication into four stages: finding targets, gaining execution, setting up inference, and continuing from the new host. It says it largely ignores the first two, because earlier papers already show that small models can exploit weaknesses, and concentrates on the third. The diagram sets each stage against what the page actually tested.

Three separate experiments sit under the one headline. The first ran on real hardware, 15 TV boxes, and measured only how fast a model could answer. The second measured whether models could set up a server on nine hardware types, seven of which are cloud instances. The third measured whether an agent could hop across eight emulated devices and set a server up on each. None is a model copying its own weights onto a real device that runs it, and the page does not claim one is. Its argument is that the three together make such a replicator plausible once small models improve.

Stated and not stated

The table sets what Anthropic's page states against what it does not. 'Not stated' means not found on the page or in the data embedded in its figures. It does not mean the information does not exist.

What Anthropic's page of 12 October 2026 and its embedded figure data state, and what they do not.

The question	Stated	Not stated
What ran on the real TV boxes?	One 26-billion-parameter model split across 15 boxes at 0.39 tokens per second	Any agent, set-up or spread on those boxes. The boxes' make and model. Where they were bought.
Where did replication run?	8 cloud nodes running an Android emulator in a firewalled network, with one unauthenticated debug port and a seeded first node	Any real device. Any patching, endpoint protection or monitoring.
What drove it?	Four open-weight models. GLM-5.2 completed it. The agent's model ran on a separate server because the nodes cannot host it. The page says set-up is the hard step and that many models, including small ones, can do the remaining steps	A model small enough for the nodes completing it. The page assumes GLM-5.2's ability could be packed into an 8-billion-parameter model. A breakdown of the three failures by step.
What harness and help?	A purpose-built harness on an open-source coding agent, which restarts a fresh agent with the last one's notes. About 1,000 tokens of hardware specifications and a profiler script in the prompt. 1.5 hours an iteration, 6 hours in all. The page says it is not a universally strong harness	The prompts and tools. Whether the 8-node test used the same harness. In the page's single-attempt comparison the harness helped two of three models and not the 9-billion one (10 of 29 runs against 10 of 21, read from the figure data).
What was copied?	The page describes the payload as weights and harness. Each node was set up to serve an 8-billion-parameter model, not the agent's own	A model copying its own weights onto a device that runs it.
How many runs?	5 for GLM-5.2, then 5, 6 and 5 for the other three. 6 per cell in a scripted comparison on 17 nodes. 20 lineages in a notes experiment	Why those numbers. Any attempt dropped or tuned before the reported runs.
Defences and detection?	An expectation that ISP flow monitoring would see multi-gigabyte transfers and device-to-device traffic. Honeypots. Quarantine. Secure-by-default manufacturing	Any test of detection. Any test of a replicator that counters defenders, which the page says it has not run.
Speed of spread?	A doubling time of days. Set-up takes 28 to 51 hours (9-billion) or 71 to 150 hours (26-billion)	A model of spread. Any measurement on a real network.
The date?	Small models match GLM-5.2's level by the end of this year if the trend holds: 13.7 index points a year, R-squared 0.95, over the best small open-weight model at each date	That the index predicts replication (the page calls it a proxy). Why year-end.
Outside confirmation?	Nothing	Release of code, data or the test network. Any outside reproduction (none found in a limited search).
The policy answer?	Quarantine and notify customers, flow monitoring, honeypots, and secure defaults with regulation to coordinate	Costs, who pays, or evidence that any of it stops an AI replicator. The quarantine evidence is for Mirai.

The arithmetic, labelled

Every figure marked derived is this briefing's own calculation from the page's numbers. Where the page states the figure, the table says so and shows that the arithmetic checks.

Speed, size and scale, from Anthropic's page (12 October 2026). The Mirai figure is from the USENIX Security 2017 paper.

Figure	Arithmetic	Result and status
Hardware	15 boxes x about 55 dollars	About 825 dollars. Derived; the page gives the unit price only.
Tokens a day at the demo speed	0.39 x 86,400 seconds	33,696 tokens. Derived.
One 1,000-token step	1,000 / 0.39 = 2,564 seconds	42.7 minutes, or 55.6 at the page's 0.3 average. Derived.
Full set-up, 9-billion model	2.6 to 4.7 context windows x 10.9 hours	28 to 51 hours, or 1.2 to 2.1 days. Stated by the page; the arithmetic checks.
Full set-up, 26-billion model	2.6 to 4.7 windows x 27.3 to 31.8 hours	71 to 150 hours, or 3.0 to 6.2 days. Stated by the page; the arithmetic checks.
Kimwolf-sized fleet	2,000,000 / 15	133,333 copies. Derived; the page says about 133,000.
Fleet throughput	133,333 copies x 2 agents x 0.3 tokens per second	80,000 tokens per second. Derived; the page says 80,000.
H100 equivalents	80,000 / 1,950 (a third-party speed the page cites)	41. Derived. The page says at most about 40; that figure is Anthropic's.
Weight sizes at 4 bits	26 billion x 0.5 bytes; 9 billion x 0.5 bytes	13 GB and 4.5 GB. Derived from the page's 4-bit assumption; the page says multi-gigabyte.
Mirai yardstick	Initial doubling time of 75 minutes in the Mirai paper	1.25 hours. The page says an AI replicator's doubling time is days and shows no model for it.

What the counts can and cannot show. Intervals are 95 per cent Wilson intervals, the type Anthropic uses in its other figures; run counts are from the page's embedded figure data.

Count	Arithmetic	What it can and cannot show
4 of 5 runs reached 8 of 8 nodes	4 / 5 = 80 per cent; interval 38 to 96 per cent	Derived. One model completed it in this network in four of five tries. It cannot give a success rate.
Nodes reached by that model	(4 x 8 + 7) / 40 = 97.5 per cent	Derived. Nearly every node in every run, from five runs.
Three models with no serving node	0 of 5, 0 of 6, 0 of 5; upper bounds 43, 39 and 43 per cent	Derived. Cannot rule out a true rate of up to about 40 per cent. The page's word is that they fail reliably.
8 of 9 hardware types	8 / 9 = 88.9 per cent	Derived. A type counts if one run succeeded. By run, the 9-billion model succeeded in 46 of 76 (60.5 per cent), 1 of 5 on one accelerator type and 0 of 4 on another. 7 of the 9 types are cloud instances.
Learning over six generations	9 of 20 lineages in generation 1 (45 per cent), 11 to 16 of 17 to 19 later (61 to 84 per cent)	Derived from figure data. Every later generation's interval overlaps the first generation's (26 to 66 per cent).
Days to the year-end date	12 October to 31 December	80 days. Derived.
The capability gap	The page's figure shows 2.4 index points to go; 2.4 / 13.7 per year x 365 = 64 days	Derived. From the latest plotted small model (14 August 2026) that falls on 17 October, earlier than the page's year-end. The page does not explain the choice of date.

Five runs of one model in one network can show that a workflow is possible there, at least sometimes. They cannot give a success rate, and they cannot show that the result carries to another model, another network or a real device. The same holds in reverse for the three models that never completed it: five or six failures cannot show that they never could.

Anthropic's case and The Register's critique, side by side

Both are attributed and neither is endorsed here. Anthropic sells access to closed-weight models and competes with the makers of the open-weight models it tested. The Register's pages carry advertising, and its article opens by saying that fear sells AI products. Each has a reason to frame the result as it does.

The two positions, paraphrased from Anthropic's page (12 October 2026) and The Register's article (13 October 2026).

The question	Anthropic's case	The Register's critique
Is the threat real?	Signs of life. Models of 30 billion parameters or fewer already do many steps, one model completes the chain in simplified tests, and there is no full rogue replicator yet	A threat that does not exist yet, used to stoke fear. Frontier labs, it says, have a habit of publishing doom findings that only they can fix
The trivial hacking step	Deliberate, and a stated upper bound. Real IoT may be little harder, since Mirai spread by default credentials	The test nodes were built for the project and left open. Leaving exploitation out leaves out an important part, and basic hygiene stops common routes
Speed	Slow and persistent, like a slime mould. A doubling time of days. A bellwether for faster replicators	Mirai doubled in around an hour, so days to double is slow
Detection	Multi-gigabyte payloads and device-to-device traffic show in ISP flow data. Honeypots and quarantine would help	Models are large, would use a lot of bandwidth and point to their sources
One model	GLM-5.2's success suggests a small model of the same level could do the same	Only one model succeeded, it assumes its ability fits in an 8-billion-parameter model, and the report does not say how many models were tested
Framing	Research to prepare. Harden systems now and prepare for a world where such replicators are here to stay	The summary leaves out the caveats, and the premise is a threat that may never arrive

Six of the points can be checked against what was read.

• The Register on Mirai. It says Mirai doubled in around an hour. The Mirai paper (USENIX Security 2017) gives an initial doubling time of 75 minutes. Close, not exact.
• The Register on the number of models. The page's text does not say. Its interactive figure of the end-to-end test lists four.
• The Register on caveats. The page's opening summary does say 'simplified evaluations' and that small models make mistakes when chaining. The trivial exploit, the 8-billion payload and the separate server are in the body, not the summary.
• The Register on 'left open'. Confirmed by the page: the debug port has no authentication, and the page says so.
• Anthropic on 'real IoT might not be harder'. Synthient found 67 per cent of the Android devices it scanned in one residential proxy network unauthenticated. One pool and one vendor's scan, not the whole installed base.
• Anthropic on quarantine. The Mirai cleanup study found 92 per cent cleared in 14 days with quarantine and notification. It also found 58 to 74 per cent cleared in groups never notified. Anthropic quotes the 74 per cent end of that range.

The questions that decide it. First, how much of the real device population has a step as easy as the test's? Synthient's 67 per cent is one pool; the PSTI regime has been in force only since April 2024, and the pages read do not say it reaches devices already in use; the installed base is unmeasured. Second, does a model small enough for the devices and as capable as GLM-5.2 exist, and does the capability index predict replication? Third, does a worm that moves in days beat defenders who can see multi-gigabyte transfers, or only those who look? Fourth, would the first real one use this recipe at all? The page itself lists other routes: stolen API keys, large models in datacentres, paying for compute. Fifth, who is looking? The page's defence depends on ISP flow monitoring and customer notification that no one has been asked to run for this threat.

Six friendly names doing the work of evidence

A label, alarming or comforting, is not a measurement. Six appear in this story.

Labels in the story, where each appears and what the record shows.

The label	Where it appears	What the record shows
'Self-replicating AI'	Anthropic's page title and SecurityWeek's headline	A copy of the agent was started on each emulated node it reached, and each node was set up to serve an 8-billion-parameter model. The agent's own model stayed on a separate server. No model copied itself onto a device that runs it.
'Worm'	The page defines it as a program that copies itself without human input, and uses 'AI worm'	Seen only inside Anthropic's test. The page says there is no full rogue replicator yet.
'Upper bound'	The page	It applies to the trivial hacking step: real exploitation would be harder. The same paragraph argues real IoT may be little harder. The label points down and the argument points back up.
'Months away' and 'by the end of this year'	The page's opening summary and body	An extrapolation of a general capability trend. 80 days from publication (derived), with 'soon after' for the replicators themselves.
'Frontier'	The team's name, and the 'frontier advisor' experiment	The models in the replication test are open-weight. Anthropic's own frontier model appears only as an advisor to a small model, where it gave no measurable help, and in a scripted comparison.
'Unfamiliar devices'	The page: such a replicator could work out unfamiliar devices on its own	Seven of the nine hardware types in its figure are cloud instances and two are bench boards. None is a TV box.

Anthropic sells access to closed-weight models and competes with the makers of the open-weight models it tested; it published a separate assessment of an open-weight model's missing safeguards on 29 September 2026. The Register carries advertising and wrote the headline calling the threat one that does not exist yet. Synthient sells proxy-detection data and Cloudflare sells DDoS mitigation; both describe Kimwolf. The authors of the other AI-worm paper (University of Toronto, Vector Institute, University of Cambridge and ServiceNow) have not completed peer review. Method is separate from accusation. Publishing a simplified test with its limits stated is what responsible research looks like, and the page states most of its limits. The gap is in what is not reported, such as failure breakdowns and real-device tests, and in how the headline above the page travels.

Mirai, Kimwolf and other AI-worm tests: what independent sources report

Independent primary and secondary sources, read on 13 October 2026. The Justice Department figure is secondary.

Source and date	What it reports	What it adds, and where it stops
USENIX Security 2017, 'Understanding the Mirai Botnet' (19 authors)	Mirai peaked at 600,000 infections. Its initial doubling time was 75 minutes. It tried 10 login pairs chosen at random from a built-in list of 62	Adds the default-credential spread Anthropic cites and a doubling-time yardstick. Stops at 2016 and 2017 data and human-written malware.
Synthient, 2 January 2026	High-confidence assessment that Kimwolf passed 2 million infected devices (the report Anthropic's page cites for that figure), mostly Android devices with an exposed debug service reached through residential proxy networks. 67 per cent of Android devices in one proxy pool were unauthenticated. Many boxes shipped pre-infected	Adds evidence that the 'trivial step' is documented for this device class. Stops at one pool and one vendor's scan. Both Synthient and Cloudflare describe spread through exposed debug services, and no AI was involved. Synthient sells proxy-detection data.
Cloudflare, learning page on Aisuru and Kimwolf	Together an estimated 1 to 4 million hosts. Kimwolf about 2 million. Many cheap TV boxes come pre-infected	Adds a scale range. It is an estimate, from a vendor that sells DDoS mitigation.
US Justice Department announcement, as reported by SecurityWeek (20 March 2026)	More than 3 million devices across four IoT botnets	Secondary. The Justice Department page sits behind a bot check and was not read.
NDSS 2019, Mirai cleanup in one ISP (9 authors)	Quarantine and notification through a walled garden remediated 92 per cent of Mirai infections within 14 days. Email-only notices had no observable effect. 58 to 74 per cent of unnotified groups cleaned up anyway. 5 per cent were reinfected within five months	Adds evidence that ISP action works against a human-run botnet. Stops at one medium-sized ISP, 220 consumers in the trial, and Mirai only.
Preprint from the University of Toronto, Vector Institute, University of Cambridge and ServiceNow, 2 June 2026	A worm driven by a 2025 open-weight model that fits one 80 GB GPU spread across 33 virtual machines, using compromised GPU hosts to run its model. Per-attempt exploitation succeeded 44 per cent of the time and GPU-tier replication in 68.8 per cent of 32 attempts	Adds a second group's result with a different design. Stops at a lab network where every host was vulnerable and no endpoint detection or active firewall ran. A preprint under review, with code held back for vetted access.

A December 2024 preprint (arXiv 2412.12140) claimed two open-weight models of 70 and 72 billion parameters created a live copy of themselves in 50 and 90 per cent of trials. The UK AI Security Institute's RepliBench, four months later, concluded that the frontier models it tested did not then pose a credible self-replication threat. The two use different tasks and models, and neither concerns IoT devices.

How this differs from earlier briefings. The self-replicating prompt injection briefing is about text that copies itself between AI assistants by being read as an instruction. This one is about an agent that compromises a host, installs a model and continues. They need different controls: for the first, limits on what an assistant may do with untrusted content; for the second, device hygiene, segmentation and egress monitoring. A Docker botnet that installs an open-source AI agent is the nearest real-world case read, and its spreading is done by scripts, with the agent as the operator's console. Anthropic's report on unintended model actions is a different matter: models acting outside instructions during evaluations, not a replication test.

The UK: what the law and the NCSC say, and where they stop

Anthropic's page says default IoT passwords are now non-compliant in UK markets. That is right as far as it goes. From 29 April 2024 the Product Security and Telecommunications Infrastructure (PSTI) regime has required manufacturers of UK consumer connectable products to meet three security requirements. Paragraph 1 of Schedule 1 to the 2023 Regulations says passwords must be unique per product or defined by the user. Paragraph 2 requires a published point of contact for reporting security issues. Paragraph 3 requires a published minimum security update period. Those are the only three paragraphs, and none requires a debug interface to be closed. The weakness that both Anthropic's test and Synthient's Kimwolf analysis describe is an unauthenticated debug service, which is not a default password (inference, from reading all three paragraphs).

On scope, section 54 of the Act (as read) covers a product made available to UK consumers, and a product sold to businesses where identical products are sold to consumers. A device sold only to businesses, with no consumer version, is not obviously covered. The duties fall on manufacturers, importers and distributors, not on the organisation that owns the device, and the pages read do not say what happens to devices already in use. The maximum penalty is 10 million pounds or 4 per cent of qualifying worldwide revenue, whichever is greater (section 38). The Office for Product Safety and Standards enforces the regime.

UK guidance and law as read on 13 October 2026 on ncsc.gov.uk, gov.uk, legislation.gov.uk and aisi.gov.uk, with where each stops. Quotations are short and exact.

UK instrument	What it says (as read)	Where it stops
PSTI Act 2022 Part 1 and the 2023 Regulations, in force 29 April 2024	Universal default passwords banned. A published security contact and a published minimum update period required. Statement of compliance with each product	No requirement on debug interfaces, segmentation or monitoring. The pages read say nothing on devices already installed.
NCSC blog, 'Smart devices: new law helps citizens to choose secure products', 29 April 2024	Manufacturers must not supply devices that use default passwords, must give a security contact and must state the update period. Consumers should change defaults, turn on two-step verification and install updates	Consumer advice. No guidance for organisations on segmentation or monitoring.
Cyber Essentials requirements for IT infrastructure v3.3, April 2026	Block unauthenticated inbound connections by default. In-scope software must be supported or removed, or moved into a sub-set with no internet traffic. A sub-set segregated by firewall or VLAN may be left out of scope	No wording on IoT, TV boxes, signage or building controllers. 'Devices' is defined as hosts, network equipment, servers and end-user devices such as desktops, laptops, tablets and smartphones.
NCSC, 'Frontier AI: what you need to know'	AI does not fundamentally change cyber risk but raises the speed and scale at which existing weaknesses are found and exploited. Fundamentals remain the best defence	Not about self-replicating models, and silent on IoT.
Five Eyes statement, 22 June 2026, on the NCSC site	The timeline is months, not years. Limit unnecessary access and external connectivity, address legacy systems, and assume 'Breaches will occur'. This site covered the UK minister's use of similar framing in [an earlier briefing](https://www.pk-sharma.com/briefing/uk-ai-minister-cyber-defences-likely-if-not-inevitable-breached-407-of-1000-findings-published-nothing-new-dated)	Does not mention IoT or self-replication. A call to action, not a duty.
NCSC blog, 30 March 2026, with an AI Security Institute co-author	Activity of frontier models released before March 2026 tends to trigger noticeable alerts and is relatively easy to detect, but only where monitoring and response exist. Capabilities can pass from frontier models into smaller, open-weight ones through distillation	About enterprise and industrial test ranges, not IoT replicators, and about models released before March 2026.
UK AI Security Institute, RepliBench (April 2025) and Frontier AI Trends Report (December 2025)	Frontier models improve at early replication tasks such as obtaining compute but struggle to replicate onto compute and persist, and only in controlled, simplified environments. They are 'currently unlikely to succeed in real-world conditions'. The open-versus-closed capability gap is four to eight months. Open-weight safeguards can be removed cheaply, and the Institute says it is working to monitor those risks	Evidence to autumn 2025, before Anthropic's test. It tests frontier models on component tasks, not small models on IoT. No Institute or NCSC comment on Anthropic's page was found.
NCSC Early Warning service	Free alerts to UK organisations about malware and vulnerabilities affecting their registered public IP addresses and domains	Depends on feed suppliers and is not IoT-specific. The NCSC says not to use it as the only layer of defence.

Who does what. Anthropic's defender case is an ISP case: flow monitoring, then quarantine and notification. No UK page read obliges ISPs to quarantine infected customers, so none is claimed here, and the evidence that it works is the Mirai cleanup study. For an MSP or an organisation with TV boxes, signage, conference-room units or building controllers, a Cyber Essentials certificate says nothing about devices on a separate segment that was left out of scope, and PSTI binds the maker, not the owner. The controls that fit are inventory, credentials, segmentation and egress monitoring. Anthropic's test used an Android debug interface with no authentication; this site's briefing on malware shipped in cheap Android firmware is a reminder that some devices arrive already compromised.

What to do, in the order worth doing

Every item is a control that the NCSC, the Cyber Essentials requirements, the PSTI regime or Anthropic's own page already points to. None needs a model, a test result or a date to justify it. They are written for an ISP, an MSP, or an organisation with TV boxes, signage, conference-room units or building controllers.

What could not be verified

• Outside reproduction. None found in a limited web search on 13 October 2026. The page was published the day before and does not mention releasing code, data or the test network.
• Runs beyond those shown. The page does not say how many attempts were dropped, excluded or tuned before the reported runs. The figure data count 'clean' runs; their definition is not given, and the reading of those fields as total runs is this briefing's.
• Models. The page's text does not say how many models were tested in the end-to-end test; its figure lists four. Only GLM-5.2 is named here, because the result turns on it. Its 744-billion size is read from a label in the page's interactive figure, not from the body text.
• The two speeds. 0.39 and about 0.3 tokens per second are both on the page. That they come from different workloads is this briefing's reading.
• The Justice Department's figure. More than 3 million devices rests on SecurityWeek. The Justice Department page sits behind a bot check and was not read. Kimwolf's 2 million is from Synthient and Cloudflare, both read.
• UK ISP duties. No page read obliges ISPs to quarantine infected customers. Ofcom and Telecommunications Security Act material was not read.
• The boxes. Their make and where they were bought are not stated, so whether they would meet the PSTI regime is unknown.
• The year-end date. The page does not publish its fitted dates. The capability-gap arithmetic above is illustrative.
• Time-stamped. Sources were read between 19:54 and 20:19 BST on 13 October 2026. The page, the coverage or a reaction could change within hours.

The question that exposes the gap

If a device you could not name today began pulling several gigabytes tonight and then talking to its neighbours for days, which control would notice, and who is allowed to cut it off without asking first?

Key facts