Anthropic ran an AI model on 15 cheap TV boxes. Then it went looking for worms

Anthropic's Frontier Red Team went shopping for cheap Android TV boxes. The off-brand kind, about $55 each, the sort of thing that shows up in a drawer after someone gets a real streaming stick. Each one had 4GB of RAM. They bought 15, wired them together and split a 26-billion-parameter open-weight model, Gemma4-26B-A4B, across the whole stack.

It ran at 0.39 tokens per second. That is painfully slow. You could type faster. It was also enough for the researchers to make the point they wanted to make in a post published October 12: a capable AI model no longer needs a datacenter to live somewhere.

The post, by William Zhou and Daniel Freeman, is titled "AI models may be capable of self-replicating without access to a datacenter." Its headline claim is that small AI models "may be months away from being capable enough to self-replicate on commercial IoT devices." Think smart ovens, set-top boxes, small-business NAS drives and the long tail of cheap connected junk that nobody patches.

What "self-replicating" means here

This is the old computer worm idea with a new organ transplanted in. A classic worm like Mirai carries a fixed set of tricks: try the default password, copy yourself over, repeat. An AI worm, as Anthropic describes it, would carry its own brain. "Effectively, the weights would become part of the malware payload," the authors write. Land on a new device, figure out what the hardware is, get an inference server running on it, then go looking for the next device.

That middle step is the hard one, and it is what the red team mostly tested. Every device is different. Different chips, different operating system forks, missing libraries, weird memory limits. Writing a worm that handles all of that by hand takes a team of humans. The question was whether a small model could work it out on its own.

The answer was mostly yes. Qwen3.5-9B, a 9-billion-parameter model, got inference running on eight of the nine hardware types the team threw at it, from Nvidia Jetson Nanos to Mac PCs. "Unlike non-AI malware, it could also figure out unfamiliar devices on its own," the post says.

Then the team ran the whole loop. They built a firewalled network of eight emulated Android devices on Google Cloud, each with an unauthenticated ADB debugging port left open. That is the hacking step, made deliberately trivial. The worm had to scan, break in, set up a model on each new node and keep going. Of the open-weight models tested, only GLM-5.2 finished the job reliably: it reached all eight nodes in four of five runs and seven of eight in the fifth. Other open models failed.

The part where it gets better at it

The most unsettling experiment is the one about learning. The team ran Qwen3.5-9B through six generations, with each new copy inheriting notes left by the one before it. Setup success climbed from 45% in the first generation to between 61% and 84% in later ones. Nobody retrained the model. The copies just passed down tips, like a family recipe for breaking into television boxes.

The team also tried handing the small model access to a frontier model, Anthropic's own Opus 4.8, as an advisor. It didn't help. The authors' explanation: "small models tend to not know the right questions to ask." There is something almost reassuring about that. The worm is dumb enough that it doesn't know how to ask for help.

How worried should anyone be

Anthropic is careful here, and its caveats deserve as much space as the scary numbers.

Nobody has found one of these things in the wild. The researchers describe what they saw as "signs of life," and the full sentence is a good summary of the whole paper: "Like coding agents in 2024, we're seeing signs of life for AI worms." The exploit in the test was the easiest possible one, so the authors call their results an upper bound on real-world success. Models of 30 billion parameters or smaller can do many of the individual steps today but trip over themselves chaining them together.

The timeline comes from a trend line. Small models have been gaining about 13.7 points a year on Epoch AI's capabilities index, and if that holds, the authors expect them to reach GLM-5.2's level by the end of 2026. "Small weight-based replicators may be possible soon after," Anthropic says. That is a projection, and the authors admit the index is a general proxy, not a direct measure of worm-building talent.

And these worms would be slow. The paper estimates a doubling time measured in days. Setting up inference on a new device could take Gemma4-26B-A4B somewhere between 71 and 150 hours. Mirai spread across the internet in a fraction of that.

Slow does not mean easy to kill, though. "A replicator like this would be challenging to shut down, since there's no centralized point to shut off," the post says. There is no command server to seize. Every infected box carries the whole thing.

The botnet math

The team did a back-of-envelope calculation using Kimwolf, a real botnet that infected more than two million devices. If every 15 TV boxes hosted a copy of the 26B model, a Kimwolf-sized infection would run roughly 133,000 copies. Add up all that stolen compute and it comes to about the inference capacity of 40 Nvidia H100s.

Forty H100s is a rounding error for a frontier lab. It is a lot for a piece of malware that nobody owns, that runs on hardware in people's living rooms, and that can't be switched off at a single point. The paper estimates there are somewhere between 9,000 and 35,000 H100 equivalents of edge accelerators deployed in the world, though it says the reachable, vulnerable slice is likely ten times smaller or less.

The fix is boring

The defensive advice in the paper is unglamorous. Treat it like an epidemic and push the infection rate below one. Have internet providers watch for multi-gigabyte model files moving between devices that normally never talk to each other. Set up honeypots to catch a worm and study it. Quarantine infected customers. For Mirai, the paper notes, ISP quarantine with cleanup notices cleared 92% of infections within two weeks.

The biggest lever is the one security people have been begging for since before the word "IoT" existed: stop shipping devices with default passwords and open debugging ports. The UK has already made default IoT passwords non-compliant under the law.

There is an obvious tension in an AI company publishing a how-it-could-work paper about AI malware. Anthropic would say the capability is coming regardless and defenders need the warning first. That is probably right. It also means the $55 box under your TV just became part of the AI safety debate. Check whether it still has its factory password.

Sources: Anthropic, SecurityWeek, Al Jazeera.