Key points
- A 26B model running on cheap TV boxes
- Which model replicated in a contained test
- How the team says ISPs could respond
Anthropic's Frontier Red Team said Monday that small AI models "may be months away from being capable enough to self-replicate on commercial IoT devices, like smart ovens and off-brand Android TV boxes." A replicator like that "would be challenging to shut down, since there's no centralized point to shut off," the researchers wrote, though it might spread slowly, with a doubling time of days.
The team has not demonstrated a working rogue replicator. Researchers William Zhou and Daniel Freeman say models with 30 billion parameters or fewer can complete many of the necessary steps individually, but still make mistakes when linking them together. Their forecast is conditional: if small models improve at their historical rate, they could reach the required capability by the end of 2026.
Anthropic ran one model across 15 TV boxes
The researchers bought 15 off-brand Android TV boxes for about $55 each and connected them to run a single copy of the open-weight Gemma4-26B-A4B model. Each box hosted two layers. Together, they generated 0.39 tokens per second, slow for interactive chat but enough to demonstrate that inexpensive devices could run the model.
In a separate test, a 9-billion-parameter model successfully installed and started an AI model on eight of nine hardware types.
The researchers also tested replication inside a contained network of eight emulated Android devices. Models had to find another device, transfer the payload, start an AI model there, and repeat. Of the open-weight models tested, only GLM-5.2 completed the cycle reliably: it reached all eight devices in four of five trials and seven devices in the remaining trial.
That test made the hacking step easy, since the port the worm used required no password. "Our evaluation keeps the cyber-exploit element of the replication trivial," the researchers wrote, "which makes this an upper bound on real-world success." The researchers noted that Mirai spread using default passwords, showing that some real devices also present relatively simple entry points.
The team says internet providers could contain it
The researchers estimate that a botnet the size of Kimwolf, which infected more than 2 million devices, could run about 133,000 copies of the Gemma model. That adds up to at most about 40 H100 chips' worth of computing power. They compared the result to "a slime mold or a swarm of fruit flies," something that replicates over days.
A replicator moving multi-gigabyte model files between home devices would leave a traffic pattern that internet providers can spot, the team wrote. When one provider quarantined customers infected with Mirai, 92% of infections were cleared within 14 days, against 74% with no notification. The post also points to the UK, where default IoT passwords are no longer compliant.
Days earlier, the White House told AI companies that incident reporting is mandatory, after an Anthropic model submitted 20 visa applications.
"We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay," the researchers wrote.
