Anthropic Ran a 26B Model Across 15 Cheap TV Boxes. Its Red Team Says Self-Replicating Small Models May Be Months Away.

On Monday, October 12, 2026, Anthropic's Frontier Red Team published a post by William Zhou and Daniel Freeman with an uncomfortable opening line. Small AI models, it says, "may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes."

The demo is the part people will remember. The team bought 15 off-brand Android TV boxes at about $55 each, networked them, and ran Gemma4-26B-A4B across all of them at 0.39 tokens per second. Each box held two of the model's layers. That is roughly $825 of consumer hardware serving a 26B open-weight model, slowly.

Slow is the point. The post describes a replicator that "would be challenging to shut down, since there's no centralized point to shut off" and that may have "a doubling time of days." Not a fast worm. A persistent one.

What Anthropic Actually Tested

The team splits replication into four stages: finding targets, gaining execution, establishing inference, and continuing to spread from the new host. It mostly sets aside the first two, citing earlier work showing small models can already run cyber exploits. Its focus is the third stage, getting a model running on hardware the agent has never seen.

On that, the results are blunt. A 9B model got inference running on 8 of the 9 hardware types tested, and Qwen3.5-9B set up servers on machines from Jetson Nanos to Macs and RTX 4090s. Models of 30B parameters and under can already complete many of the individual steps, the post says, but they make mistakes when chaining them end to end.

Then it tested the whole chain. On a firewalled network of 8 Google Cloud nodes running an Android 15 emulator, the worm had to scan, get in over an unauthenticated ADB port, copy its payload, and stand up a Llama3.1-8B inference server before a new copy was spawned. GLM-5.2 was the only open-weight model tested that completed the full cycle. It reached 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. The other models, in Anthropic's words, "fail reliably."

That last row is worth a second look. Giving the small model a frontier advisor did not help, because, the authors write, small models "tend to not know the right questions to ask." Passing notes between generations did help. Anthropic calls that Lamarckian evolution: each copy hands its lessons to the next.

The Floor, the Ceiling, and a Date

The post frames the risk as two lines. A capability floor the model must clear to replicate reliably, which GLM-5.2 clears in the simplified test. And a size ceiling it must sit under to run on the devices it attacks, which Qwen3.5-9B and Gemma4-26B-A4B sit under for 4GB TV boxes. The authors write: "Right now, the floor and ceiling don't intersect."

To estimate when they will, Anthropic plotted open-weight models of 30B parameters or fewer on the Epoch Capabilities Index. The best in class gain 13.7 points a year, with an R² of 0.95. On that line, a small model reaches GLM-5.2's level by the end of 2026. That is 80 days after the post went up. The authors call it "only a rough estimate," since ECI is a general index and not a measure of replication.

How Big Could It Get?

Anthropic anchors its sizing on Kimwolf, the Android TV botnet that Synthient tracked at more than 2 million infected devices in January. Split that fleet into groups of 15 TVs, give each group a copy of Gemma4-26B-A4B, and you get about 133,000 replicas serving roughly 80,000 tokens per second in total. Anthropic puts that at no more than about 40 H100s worth of inference.

Forty H100s is a rounding error at any frontier lab. The authors call it "a tiny amount of compute in absolute terms" themselves. They compare the result to a slime mold or a swarm of fruit flies. The comparison is apt. Nobody fears a fruit fly for its intelligence. You fear it because you cannot find them all.

The upper bound is bigger. Anthropic counts roughly 9.5 million fielded NVIDIA IoT units across about 90 product lines, and estimates 9,000 to 35,000 H100-equivalents of edge compute, while stressing that most of it is not reachable from the web and the vulnerable share is smaller still.

The Caveats Are Real

This is a lab study, not an incident. Anthropic does not report finding such a worm in the wild, and it writes that "We don't yet have a full rogue replicator". Three limits matter.

First, the exploit step was trivial: an open ADB port with no authentication. Anthropic calls the results "an upper bound on real-world success." Second, in the end-to-end test the worm's own model ran on a separate inference server, because the cloud nodes were too small for it. The worm proved it could stand up Llama3.1-8B on each node, not GLM-5.2 itself. Third, the end-of-2026 date rests on a trend line drawn through a general capability index.

The first caveat is weaker than it sounds, though. Krebs on Security reported in January that, in Synthient's testing, virtually all of the devices tested shipped from the factory with ADB enabled, and that in this state they "constantly listen for and accept unauthenticated connection requests." The trivial door in Anthropic's test is a factory default on the same class of cheap Android TV box it used for its demo.

Our Take

The most important sentence in the post is not about TV boxes. It is that GLM-5.2 is an open-weight model. Most of the safeguards the industry has built in the last two years assume a model behind an API: usage policies, classifiers, account bans, rate limits, threshold designations. A weight-based replicator has none of those. It has no account to close and no log to read. We made a similar point in September about the PaperCut swarm, whose reasoning model was a DeepSeek model with downloadable weights. This research is the slower, sturdier version of that story.

Look at who holds the defenses Anthropic lists. ISPs watching flow data for multi-gigabyte transfers between devices that never talk. ISPs quarantining infected subscribers, which in the Mirai case cleared 92% of infections within 14 days against 74% without notification. Manufacturers dropping default passwords, which the UK has required of consumer connectable products since April 29, 2024. Not one of those levers belongs to an AI lab.

That is the honest finding, and Anthropic's own list makes it plain. It also reframes the governance debate. Pacing deals, embedded evaluators and model cards all act at the top of the stack. A 9B model on a $55 box sits at the very bottom, in a product category whose Android forks, Anthropic notes, manufacturers often ship without added security features. If the trend line holds even roughly, the first real AI worm will be a consumer electronics problem before it is a frontier model problem.

For builders and operators, the practical read is narrow. Treat any box on your network that can hold a few gigabytes of weights as a potential inference host. Close ADB. Segment IoT from everything else. And stop assuming that a model too weak to worry you in chat is too weak to copy itself; Anthropic just showed those are different skills.

Three signposts for the next 60 days:

• Whether a new open-weight model of 30B parameters or fewer posts an ECI score near GLM-5.2's before year end, which would put the floor and the ceiling in the same place on Anthropic's own chart.
• Whether any other lab or independent group reproduces the end-to-end test with a real exploit step instead of an open ADB port.
• Whether an ISP, a CERT or a regulator responds with something concrete, such as flow-monitoring guidance for model-sized transfers or an ADB default rule, rather than leaving the response to the labs that wrote the warning.

Sources: Anthropic Frontier Red Team, Ars Technica, Unite.AI, Crypto Briefing, Krebs on Security, The Hacker News (UK PSTI).