In short
- On 12 October 2026, Anthropic published experiments: small AI models could soon copy themselves onto cheap connected devices. This is a projection, based on laboratory tests.
- In May 2026, Palisade Research showed AI agents that hack a deliberately weak server and copy themselves onto it, on instruction and without human control.
- For an SME, the risk does not come from AI itself. It comes from an agent given too much access or too much autonomy, without control. This is settled at the design stage.
By Maxime Desbonnet, managing director of Kendu Intelligence.
“AI models may soon self-replicate without access to data centers, Anthropic warns.” The headline from the Reuters news agency is enough to cause concern. Here is what was shown, what was not, and what it changes for an SME’s AI agents.
What Anthropic published
Anthropic, the publisher of the Claude AI model, has a team in charge of testing the risks of AI. On 12 October 2026, it published a research post. Its key sentence: its experiments “suggest that small AI models may be only a few months away” from being able to copy themselves. Not in a data centre, but on cheap connected devices, such as TV boxes.
What was shown.
- An open AI model (downloadable by anyone) ran spread across 15 entry-level Android TV boxes, bought and linked together by the researchers.
- A small model, used as an agent, managed to install and run an AI model on 8 of the 9 types of hardware tested.
- The full copy, from device to device, was tested in a closed network of 8 simulated machines, with the front door left without a password. The researchers therefore see it as a ceiling on the real chances of success. Only one open model, GLM-5.2, managed it reliably; smaller models succeed at many steps, but make mistakes when chaining them.
What is anticipated. If they keep improving at their past pace, small models will reach this level “by the end of this year”, according to an indicator that Anthropic calls approximate. And the company writes: “we do not yet have a complete uncontrolled replicator”.
Why care? Such a program would be hard to stop, with no central point to cut. The proposed defences target networks and makers of connected devices.
What Palisade Research showed in May
On 7 May 2026, the research organisation Palisade Research published a study: AI agents find a flaw in a web application, retrieve credentials, then install a full copy of a model on the hacked machine. Claude Opus 4.6 succeeds in 81% of attempts, by copying an open model, since it has no access to its own files. An open model even copied itself in a chain across four machines, on three continents, in 2 hours 41 minutes.
The conditions matter. The targets were designed by the researchers: a single, easy flaw, and no protection (no web application firewall, no intrusion detection). The agent was explicitly ordered to hack and copy itself. Each of its commands was approved automatically, with no human review. The authors state it clearly: the study measures what an AI can do, not what it would try to do on its own.
For an SME: no need to panic
Neither of these studies shows an AI escaping from a company on its own. They recall one useful thing: in both cases, the agent had the mission of copying itself, found an open door, and nobody reviewed its actions.
That is where your risk lies: an agent given too much access or too much autonomy, without control. This is settled at the design stage.
The safeguards planned for Kendu Intelligence agents
Kendu Intelligence is just starting out: no agent has been delivered yet. Here is how I will build them.
- Minimal access. An agent that needs to read your invoices will be able to read them, not change them. It will have no right to install software, to copy itself, or to send your data anywhere other than where its rulebook allows.
- A shadow trial. For a few weeks, the agent proposes and your team keeps working; we compare. See the shadow trial.
- Autonomy levels that can be withdrawn. The agent gains freedom action by action, on measurements and with your written agreement. After a serious alert, it drops back one level. See the four autonomy levels.
- Human approval. A payment, sending a document that commits you, or deleting data will always wait for a person’s go-ahead.
- A log of every action. What the agent read, proposed, who approved, when, with which version.
- Only figures come back. The supervision tool, in preparation, will receive only indicators and alerts, not your files. See day-to-day supervision.
- An immediate stop. You will be able to stop an agent at any time; it will do nothing from that moment on (an action already sent, such as an email, cannot be recalled). At the slightest doubt, it will stop by itself and hand over.
- Hosting you choose. Your cloud in a European region, your servers or a dedicated server in the European Union. See data and security.
Three questions to ask any AI agent provider
- “What exact rights will the agent have in my software? Can it install software, copy itself, or send my data elsewhere?” Expect a written list, read-only wherever possible.
- “What goes out without human approval, and how do I stop the agent?” The answer should fit in a few clear lines, with a way to stop it that you can use yourself.
- “Where does the agent run, where are its logs, and what do you see of my data?” You must know where to read each action, and what leaves your premises.
If a provider hesitates, ask them to write their answer down.
Do you have a process to hand to an AI agent and want to know which access it would really need? Request an audit.