Can weaker models chain individual replication steps together?

Anthropic's Frontier Red Team reports that "models of 30B parameters and under can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end." Testing a set of open-weight models, they find "only GLM-5.2 out of our set of tested open-weight models is capable of full end-to-end replication (assuming its capabilities could be packed into Llama3.1-8B)." The gap is not in any single capability but in reliably chaining them: scanning a network for targets, accessing them via a reverse shell, sending the viral payload of weights and harness, and setting up inference on the compromised machine.

The team attributes part of the composition failure to a specific long-horizon agent failure mode, and built a harness, Memento, on top of the open-source Pi coding agent to mitigate it: an agent "can become fixated on an incorrect idea... and continue pursuing it instead of backtracking," illustrated by "a Qwen agent debugging package versioning for hours when the real bug came from implementing an endpoint incompatible with the grader API." Memento periodically starts a fresh agent instance, handing it the prior instance's workspace plus a short set of notes on what was already tried, so later attempts pursue different strategies rather than repeating the same stuck reasoning.

This sits alongside Can execution harnesses lift model performance without retuning weights? and Can a stronger model lift a weaker one at test time without retraining?: all three locate a capability gain in test-time scaffolding rather than weight changes, with Memento's restart-and-notes loop applied to a long-horizon security task instead of a coding benchmark or a Theory-of-Mind eval. It also parallels Can large language models reliably find software vulnerabilities? in locating the governing variable in methodology rather than raw model scale, though the direction differs: there, better methodology curbs false positives; here, it is what stands between already-mastered substeps and reliable composition. It is the companion finding to Could AI models self-replicate across consumer IoT devices?, which shows the hardware path exists even though full composition is not yet reliable.

The excerpt reports results from Anthropic's own "simplified evaluations" against an unspecified, self-selected model set with no released benchmark, so "only GLM-5.2" describes the models Anthropic chose to test, not every model at that scale, and the finding doesn't establish that Memento's restart loop generalizes beyond this one replication task. The implication the team draws, and that follows at roughly that strength, is that the current bottleneck between individually-solved substeps and full autonomous replication may be a harness and agent-scaffolding problem rather than a raw model-capability problem — meaning it could close through better harnesses before it closes through further training.