- Anthropic ran Gemma4-26B across 15 off-brand Android TV boxes at 0.39 tokens per second, and a 9B model managed to install a working model server on 8 of the 9 hardware types tested.
- In a firewalled test network, Zhipu's open-weight GLM-5.2 completed the full replication cycle, reaching 8 of 8 nodes in 4 of 5 runs, and Anthropic's trend line puts models of 30B parameters or fewer at that level by the end of 2026.
- Such a worm would be slow, with a doubling time of days, but it would have no central off switch, which turns ISP monitoring and IoT security rules into the main defenses.
Anthropic's Frontier Red Team has shown that a capable AI model can run on a stack of fifteen $55 TV boxes, and it estimates that small open models may be able to copy themselves from device to device across the internet within months. The finding moves a long-standing safety concern, autonomous replication, out of the datacenter and into the cheapest, least defended computers in homes and small offices.
A 26B model ran on fifteen $55 TV boxes in Anthropic's lab
The research post, written by red-team researchers William Zhou and Daniel Freeman, breaks replication into four steps: finding targets, getting code to run on them, standing up model inference on the new machine, and spreading again. Earlier academic work had already shown that small models can handle the hacking steps. Anthropic focused on the step that had barely been measured, which is getting a model to run on unfamiliar, underpowered hardware with no human help.
The team bought fifteen generic Android TV boxes, each with 4GB of memory, and split Google's Gemma4-26B model across them so that every box held two of its layers. In separate tests, small open models such as Qwen3.5-9B set up working inference servers on hardware ranging from Nvidia Jetson Nanos to Macs. Anthropic then built an eight-node test network of emulated Android devices with an open, unauthenticated debug port and dropped each model in as the payload. Only GLM-5.2 completed the whole loop reliably.
The test turns on a capability floor and a size ceiling meeting
Anthropic frames the risk as two lines converging. A replicating model has to be smart enough to chain every step without supervision, and small enough to run on the devices it infects. GLM-5.2 clears the first line but is too large for a TV box, while Qwen3.5-9B and Gemma4-26B fit the hardware but fail end to end. Plotting the best open models of 30B parameters or fewer against the Epoch Capabilities Index, the researchers found a gain of 13.7 points a year and projected that a small model will reach GLM-5.2's level by the end of 2026.
| Devices infected by the Kimwolf IoT botnet at its peak | More than 2 million |
| Model copies such a fleet could host, 15 boxes each | About 133,000 |
| Equivalent inference capacity of that fleet | About 40 Nvidia H100 GPUs |
| Setup success for a 9B model passing notes across generations | From 45% to between 61% and 84% |
The most unsettling result concerns learning. Each Qwen3.5-9B instance wrote short notes on what it tried before handing off to a fresh copy, and the success rate at installing inference rose from 45% in the first generation to between 61% and 84% in later ones. Malware that improves as it spreads, by inheriting its ancestors' notes, has no real precedent in pre-AI botnets such as Mirai, which were hard-coded for one class of device.
“Like coding agents in 2024, we're seeing signs of life for AI worms.”
William Zhou and Daniel Freeman, Anthropic Frontier Red Team, October 12, 2026
The floor model has already been overtaken
The capability floor in Anthropic's test is a model that is no longer Zhipu's best. On September 29, Anthropic itself reported that the newer GLM-5.3 built working browser exploits where GLM-5.2 scored near zero, and that a smaller GLM-5.3-Flash assembled an exploit chain for $20.40 in API fees. Open-weight model families now ship successors every few months, so the end-of-2026 estimate depends on how fast open-weights developers shrink that capability into small, distillable models, a pace no single lab controls.
The binding constraint on an AI worm is no longer compute. Fifteen discount TV boxes are enough, and the world already holds millions of them.
Anthropic is also careful about the limits. Its network kept the hacking step trivial, the swarm's total compute would equal about 40 H100s, and replication would take one to two days per hop for a 9B model. Frontier advice made no difference either: giving Qwen3.5-9B access to Claude Opus 4.8 as an advisor produced no measurable gain, because the small model did not know what to ask.
Defenders get a slow worm, and no switch to turn it off
The practical message for security teams is that the defenses already exist but sit with ISPs and device makers rather than with AI labs. A weight-based replicator would leave a visible signature, multi-gigabyte model downloads followed by steady device-to-device traffic, and ISP quarantines cleared 92% of Mirai infections within 14 days in one documented case. Rules banning default IoT passwords, already in force in the UK, shrink the pool of targets. Korea's bank breaches tied to an autonomous hacking tool show that the hacking half of the chain is already appearing in the wild.
Anthropic's paper describes a threat that would look less like a sudden takeover and more like a slow infection living on the internet's forgotten hardware, with no datacenter to shut down and no single owner to call. The race it sets up runs between small open models getting better at chaining tasks and the IoT industry finally fixing defaults it has ignored for a decade, and on Anthropic's own trend line the models are on schedule to arrive first.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.