Anthropic bought 15 off-brand Android TV boxes for about $55 each, wired them together, and got a 26-billion-parameter AI model running across all of them. It answered at 0.39 tokens per second, slower than a person types. The speed was never the point. The point was that a cheap pile of living-room gadgets could host a working AI model at all, and that an AI agent might one day set that up by itself.
That experiment sits at the center of a report Anthropic’s Frontier Red Team published on October 12, written by researchers William Zhou and Daniel Freeman. Its opening line is blunt: “Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes.” In plain terms, Anthropic is describing an AI worm: software that breaks into a device, copies its own model weights onto it, starts running, and then goes looking for the next victim. Nobody has built a complete one yet. Anthropic’s argument is that the pieces are arriving faster than most people expect.
The short version
- Anthropic’s Frontier Red Team says small open AI models could be able to copy themselves across cheap smart devices by the end of 2026, if current trends hold.
- In a sandboxed test, the GLM-5.2 model spread to all eight emulated Android devices in four of five runs. The hacking step was deliberately easy, so that is a ceiling.
- At the scale of Kimwolf, a botnet of over two million TV boxes, such a worm might run about 133,000 copies, roughly the power of 40 Nvidia H100 chips.
- No complete AI worm exists yet. Early ones would likely be slow but hard to kill, with no central off switch.
- The best defense is old-fashioned: patched firmware, unique passwords, segmented networks, and retiring unsupported gadgets.
What Anthropic actually tested
The report breaks self-replication into a chain of steps: find a vulnerable machine, get in, figure out what hardware it has, install the software needed to run a model, copy the model over, start it up, and repeat. Anthropic’s finding is that models with 30 billion parameters or fewer “can already complete many of the individual steps for replication today, though they make mistakes when composing them end to end.”
Some of the results are striking. Qwen3.5-9B, a small open model, got an inference server running on 8 of the 9 hardware types the team tried, from Nvidia Jetson Nano boards to Macs and gaming PCs with RTX 4090 cards. Conventional malware is usually written for one chip and one operating system. An AI agent can read error messages and adapt. “Unlike non-AI malware, it could also figure out unfamiliar devices on its own,” the report says.
The end-to-end test ran on eight Google Cloud machines running an Android 15 emulator inside a firewalled network, each with an unauthenticated Android Debug Bridge (ADB) port left open. That mirrors a real weakness in cheap TV boxes that ship with network debugging switched on. GLM-5.2 copied itself to all eight nodes in four of five trials and reached seven in the fifth. No other open-weight model the team tried did it reliably.
Copies can also learn from each other. When each new generation of Qwen3.5-9B inherited notes from the last, its success rate at setting up inference rose from 45% to between 61% and 84%.
Why a botnet of TV boxes is the yardstick
To size the threat, Anthropic borrowed numbers from a real infection. Kimwolf surfaced in late 2025, when researchers at QiAnXin’s XLab reported it had enlisted at least 1.8 million devices, mostly uncertified Android TV boxes and set-top boxes. Anthropic puts its peak at over two million. Many were compromised through firmware flaws or trojanized apps, and some were reportedly sold already infected.
If an AI worm could take over a fleet that size, Anthropic estimates it might field about 133,000 working copies of a model, serving roughly 80,000 tokens per second in total. That is about what 40 Nvidia H100 data center chips deliver at high load. The researchers call this a rough figure anchored to one device class and one past botnet.
Forty H100s is a modest cluster by AI industry standards. The worry is less raw power than persistence. Such a replicator “would be challenging to shut down, since there’s no centralized point to shut off,” the researchers wrote, though it “may be slow (with a doubling time of days).” Their sharpest point is about motivation. “While it’s true that IoT devices have been vulnerable for a long time, lightweight agents may be much more willing than human attackers to put in the effort to compromise large fractions of the world’s IoT compute.” Human hackers skip obscure smart fridges because the payoff is small. An agent that never gets bored does not.
We have been here before, just without the AI
Self-spreading code that lives on household gadgets is not new. In 2016 the Mirai botnet tore through internet-connected cameras, DVRs and routers by trying a short list of factory default usernames and passwords. A study presented at USENIX Security in 2017 traced its growth to a peak of about 600,000 infections. On October 21, 2016, Mirai-infected devices flooded the DNS provider Dyn and knocked major websites offline across the US for hours.
The AI angle has a history too. In March 2024, researchers Stav Cohen (Technion), Ron Bitton (Intuit) and Ben Nassi (Cornell Tech) unveiled Morris II, named after the 1988 Morris worm. It hid self-replicating prompts in emails so that AI assistants built on models like Gemini Pro, ChatGPT and LLaVA would leak data and pass the prompt on. It never left the lab. Then in November 2025, Anthropic disclosed that a group it assessed with high confidence to be a Chinese state-sponsored actor, which it called GTG-1002, had used Claude Code to run an espionage campaign against about 30 organizations, with AI handling an estimated 80% to 90% of the tactical work. It was not a worm, but it showed how far automation had come.
| Threat | Year | Targets | How it spread | Scale |
|---|---|---|---|---|
| Mirai | 2016 | Cameras, DVRs, routers | Factory default passwords over Telnet | About 600,000 infections at peak |
| Morris II | 2024 | AI email assistants | Self-replicating prompts hidden in messages | Lab demo, not seen in the wild |
| Kimwolf | 2025 | Off-brand Android TV boxes | Firmware flaws, trojanized apps, some sold pre-infected | 1.8 million+ (XLab); over 2 million at peak (Anthropic) |
| GTG-1002 | 2025 | About 30 organizations | Claude Code used as an attack orchestrator (not a worm) | A small number of confirmed intrusions |
| Anthropic test replicator | 2026 | Emulated Android devices | AI copies its own weights and starts inference | 8 of 8 sandboxed nodes in 4 of 5 runs |
The warning lands in a tense week. Days earlier, Bill Gates said AI-powered cyberattacks are the near-term risk he worries about most. Meanwhile, smart home platforms are opening up to AI agents on purpose: Google now lets outside AI agents control Google Home devices.
The size of the target
The pool of potential hosts keeps growing. IoT Analytics counted 18.5 billion connected IoT devices at the end of 2024 and expects 21.1 billion by the end of 2025, rising to 39 billion in 2030. Phones and laptops are not included. Inside homes, telemetry from Bitdefender and NETGEAR covering more than 6.1 million households found an average of 22 connected devices per home and about 29 attacks against them per day in 2025, up from 10 a day in 2024. Streaming devices and smart TVs were the most frequent targets.
What Anthropic says defenders should do
The report does not argue for panic. It argues that a weight-copying worm would be noisy. Moving gigabytes of model files between consumer devices creates unusual traffic that internet providers could spot, and the faster a worm spreads, the louder it gets. Honeypots, decoy devices built to be infected, could capture its code. Anthropic also points to the Mirai cleanup: when internet providers quarantined infected customers and sent cleanup notices, that “cleared 92% of infections within 14 days, against 74% with no notification.”
The last line of defense is the device itself. “We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay,” the researchers wrote. Regulators have started. The UK’s Product Security and Telecommunications Infrastructure regime, in force since April 29, 2024, bans universal default passwords on consumer connected products and makes sellers state how long devices will get security updates. Anthropic cites it directly: “default IoT passwords are now non-compliant in UK markets.” Under the EU’s Cyber Resilience Act, manufacturers have had to report actively exploited vulnerabilities within 24 hours since September 11, 2026, with full security requirements applying from December 11, 2027. The US Cyber Trust Mark, the FCC’s voluntary smart device label, is still being set up: UL Solutions quit as its lead administrator in December 2025, and the FCC picked the ioXt Alliance in April 2026.
What you can do this weekend
- Update firmware. Turn on automatic updates for your router, TV, cameras and hubs. Check the router’s admin page by hand if it has no auto-update option.
- Kill default passwords. Give every device and its companion app a unique password, and turn on two-factor login for smart home accounts.
- Split your network. Put smart gadgets on a guest network or a separate VLAN so a hacked TV box cannot reach your laptop or phone.
- Turn off UPnP. Universal Plug and Play lets devices open ports on your router without asking. Most homes do not need it.
- Check Android TV boxes. Disable developer options and network debugging (ADB). Avoid no-name boxes from marketplaces, the kind Kimwolf feasted on.
- Retire orphaned devices. If a gadget no longer gets security updates, unplug it or replace it. A cheap camera with dead firmware is exactly the kind of host an automated attacker will not skip.
Anthropic’s own phrasing sums up where things stand: “Like coding agents in 2024, we’re seeing signs of life for AI worms.” Coding agents went from clumsy demos to everyday tools in about two years. If AI worms follow that curve, their likeliest hosts are already in our living rooms, unpatched and forgotten. Fixing that needs no new technology, just the dull work the industry has put off since Mirai.
Sources and further reading
- UNILAD Tech: Anthropic warns AI-powered ‘worms’ could infect your smart devices
- Anthropic: AI models may be capable of self-replicating without access to a datacenter
- Anthropic: Disrupting the first reported AI-orchestrated cyber espionage campaign (PDF)
- arXiv: Cohen, Bitton and Nassi, the Morris II generative AI worm paper
- USENIX Security 2017: Understanding the Mirai Botnet
- IoT Analytics: State of IoT 2025, number of connected IoT devices
- Bitdefender: Bitdefender and NETGEAR 2025 IoT Security Landscape Report
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
