Anthropic’s Frontier Red Team gave Qwen3.5-9B access to Opus 4.8 as an advisor and measured whether the advice made the small model better at setting up inference on unfamiliar hardware. Success rates stayed flat. The team offered the advisor as a tool call and, in a second arm, pushed its advice to the small model whenever it stalled. Both arms stayed flat.
A version first trained with reinforcement learning to call an advisor on coding problems still struggled to ask for useful help. The authors take that result, add that small models are persistent agents on their own, and judge coordination more likely to come from:
a large model handling high-level strategy and spinning up small models as subagents.
Ok, supervised agent swarms is one way of working, but that doesn’t mean it is a necessary one.
The same paper builds its threat model on the independence of small models. A small replicator carries its own weights onto cheap devices, and the authors judge it hard to shut down because the swarm has no central point to switch off.
A swarm is a distributed compute model, and distributed systems carry their own power-off by design. Every node runs the same program, and the program checks a condition before it continues: a lease that expires, a signed stop command from any peer, a heartbeat that goes quiet. Any one of those switches off the whole swarm with no central server anywhere. The Internet already works this way. A BGP route withdrawal propagates router to router with no central router. A TLS certificate stops working on the expiry date written into it at issuance. A DNS record dies on its TTL.
The paper’s own precedent shows the same property. FritzFrog takes commands from any peer, which is how Guardicore joined the network with its own client and issued commands to it.
A distributed swarm has no central point and an off switch at the same time.
The design question is who holds a key, and the paper very suspiciously never asks it, perhaps because they don’t fully understand the topic of swarm safety. I have written about it extensively in designing a swarm harness called Wirken, which is open source and free, for those who want more details.
The hardware work seems logical. The team ran Gemma4-26B-A4B across 15 off-brand TV boxes at 0.39 tokens per second, on ARM processors limited by memory bandwidth.
The problem is with the inference made by the authors from those experiments.
| A | Large-model advice leaves small-model success flat, asked or unasked. |
| B | Small replicators are hard to kill because the swarm has no central point. |
| C | Expect a large model to direct small subagents. |
| Paper | A ∴ C, while holding B |
C needs a channel from the large model to the small one that carries useful instruction. A measured that channel and found it flat. The arm that pushed advice whenever the small model stalled is the closest the paper comes to testing a large model intervening in a small model’s work, and it showed no significant gain. A counts against C. The paper derives C from A in a single sentence, so the authors reach their conclusion from evidence against it.
The paper’s defenders have one point. It reports that small models complete individual replication steps and make errors when chaining them end to end, so a large model handling the chaining while small models handle the steps is a coherent design. The paper offers that design as an expectation. The expectation is left untested. Or perhaps they tested it and decided not to publish the result because it made Anthropic look bad.
C also cancels B.
B depends on the swarm having no central point, and C adds one.
A large model directing many small ones is a central point by construction, and it runs where large models run, in a datacenter or behind an inference API. The paper describes an API-based replicator as one that needs a model provider to serve it unknowingly, and judges it easier to discover. A strategist on an API puts command of the worm inside a vendor’s product, where the vendor holds the logs and can revoke the keys. Taking out the strategist takes out the coordination C describes. B and C each describe a replicator, and they describe two different ones.
Takedowns aim at central command.
Microsoft disabled Rustock in 2011 by seizing its command and control servers from five hosting providers in seven US cities and severing the IP addresses that controlled the botnet. FritzFrog and P2PInfect put command in the peers instead. Guardicore found that FritzFrog distributes control across all of its nodes, and Unit 42 found P2PInfect running on a peer-to-peer command and control network. The Anthropic paper cites both as precedents for its small replicator.
The paper’s own data points to a very different conclusion.
In its Memento harness, each Qwen3.5-9B instance kept notes on what it tried and what failed, and a fresh instance inherited them. Setup success rose from 45 percent in the first generation to between 61 and 84 percent in later ones. Small-to-small transfer raised success, while large-to-small transfer left it flat. The one Anthropic model in the experiments, Opus 4.8, appears only as that advisor.
In April I read the Mythos system card and found an engineering research voice that refused to sign the number that the marketing voice was pushing in the headlines. The research voice said the model weaponized two bugs another earlier model found, in patched software, with the sandbox off. The marketing voice said thousands of zero-days. I think we all know how the marketing turned out.
Six months on, I see the conflict of these two voices again, compressed into a single paragraph. Engineering says that a large model adds nothing to a small one. Marketing, in the next sentence, puts the large model in charge. A company with a mature risk owner would have reconciled the giant gap between those two sentences before publication. It strikes me that Anthropic doesn’t have strong enough security leadership.
| D | Small models improve on notes inherited from small models. |
| Supported | A ∧ D ∴ small coordinates with small |
| Non sequitur | A ⊬ C |
| Inconsistent | C → ¬B |
The supported inference keeps the premise of B intact: the swarm has no central point. It describes the replicator the experiments produced: small models running their own weights and passing notes forward to their successors.
The paper’s sentence that a large model is the more likely director follows from nothing in its data. It appears to be a hallucination by the authors.
Every measured result in the paper has small models working alone and teaching each other. That makes sense. That’s logical as well as consistent with Internet history. Nobody needs an IBM. Nobody needs Amazon. The market should not favor hedge and capture by artificial pressure. The paper’s own data shows a large model adds nothing to a swarm of small ones.
Nobody needs Anthropic.