AI Worms on $55 TV Boxes: What Anthropic Actually Showed

Anthropic's Frontier Red Team bought 15 cheap Android TV boxes, about $55 each, wired them together and ran a 26 billion parameter AI model across them. It worked, slowly: 0.39 tokens per second. That demo opens an Anthropic report published on October 12, 2026. Its claim is careful and unsettling at once. Small open models are not yet able to copy themselves across the internet on their own, the authors write, but they may be months away from being capable enough to do it on commercial internet of things devices, and such a replicator would be hard to shut down because there is no central point to switch off.

A worm that carries its own brain

A computer worm copies itself from machine to machine without human input. In the scenario the team studies, the worm also carries its model weights as part of the payload and runs inference directly on the hardware it compromises. No datacenter, no API key, no company to call.

The authors set aside the hacking step, since earlier papers already show small models can execute cyber exploits. Their focus is the least studied one: can a small model get a model running on hardware it has never seen?

What was measured

Often, yes. Qwen3.5-9B, a 9 billion parameter open model, got an inference server running on 8 of the 9 hardware types tested, from a Jetson Nano to Mac computers and RTX 4090 graphics cards. Stronger models such as GLM-5.2 were more reliable.

The second test chained the whole cycle. The team built a firewalled network of 8 Google Cloud nodes running an Android 15 emulator. A worm started on one node had to scan the network, get in through an Android Debug Bridge (ADB) port left open with no authentication, deliver its payload and stand up a working model. Every candidate had to serve the same model, Llama3.1-8B. Only GLM-5.2 completed full replication, and it did so reliably: it reached all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. The other open models tested failed reliably.

The authors are explicit about the shortcut. Because the ADB port required no password, the exploit step was trivial, which makes the result an upper bound on real world success. They add that real IoT security may not be much harder: the Mirai botnet spread by trying default manufacturer passwords.

The test door was an open ADB port. Real botnets have already walked through that exact door.

That point is not hypothetical. Kimwolf, the botnet Anthropic uses as its reference, infected more than 2 million devices, mostly off brand Android TVs. Synthient, the security firm that tracked it, reports that it spread primarily by targeting Android devices with an exposed ADB service, and that 67% of the Android devices it examined in one large proxy pool answered without authentication. The idea that cheap hardware is never left open in practice does not survive those numbers.

What was projected

The forecast rests on a trend line. Anthropic plotted open models of 30 billion parameters or fewer against the Epoch Capabilities Index, a general benchmark of model ability. The best small models gained 13.7 index points per year, with an R squared of 0.95. Taking GLM-5.2 as the capability floor for replication, the line reaches that level with a small model by the end of 2026, and the authors add that small replicators may be possible soon after.

They label the limits themselves: the index is only a proxy for replication ability, so the date is a rough estimate. "Capable within months" is about when a model could do it, not a claim that a worm will spread within months. The report says such a worm would be slow.

How slow is slow

On the real TV boxes, the 26B Gemma model averaged about 0.3 tokens per second in actual agent work. At that pace a reply of 100 tokens, roughly a short paragraph, takes about five and a half minutes. Completing one full inference setup took an estimated 71 to 150 hours for Gemma and 28 to 51 hours for Qwen3.5-9B. The report puts the doubling time in days and compares the result to a slime mold.

Scale changes the picture. A fleet the size of Kimwolf, split into groups of 15 boxes, would hold about 133,000 copies of the model and produce around 80,000 tokens per second in total. That equals at most about 40 Nvidia H100 chips, a tiny amount of compute. The danger the authors describe is persistence, not power.

One more result explains why this differs from ordinary malware. When each new Qwen3.5-9B instance inherited short notes from the previous one, its setup success rose from 45% in the first generation to between 61% and 84% in later ones, across 20 lineages. A much stronger advisor model, Opus 4.8, produced no measurable improvement.

The defense already has a track record

A replicator spreading at scale would leave traces: multi gigabyte downloads to small devices, sustained traffic between machines that do not normally talk, and scanning. The faster it spreads, the louder it gets.

The strongest evidence comes from Mirai. In a study presented at NDSS 2019, a medium sized internet provider quarantined infected customers in a walled garden and told them how to clean up. That removed 92% of infections within 14 days, while 58% to 74% cleared on their own in groups that were not notified. Anthropic also points to the United Kingdom, where default IoT passwords are no longer allowed. For how other AI security claims sorted into proven and asserted, see our check of September's rogue agent stories.

The part of this report that will age best is not the forecast. For years, cheap connected devices were protected mostly by being worth almost nothing to an attacker. A patient AI agent changes that arithmetic: 2 million slow boxes nobody updates add up to something that never sleeps and has no off switch. The tools to contain it already exist at the internet provider level. Whether anyone uses them before the trend line arrives is a question about incentives, not about models.