AI Models Could Soon Copy Themselves Onto Smart TVs and Gadgets, Anthropic Warns

TUESDAY, OCTOBER 13, 2026

The boxes cost about $55 each. Anthropic’s safety team bought 15 off-brand Android TV boxes, networked them together, and got a 26-billion-parameter AI model running across the fleet — slowly, at less than half a word per second. The point was never the speed. It was the question the demo was built to answer: could an AI model one day copy itself onto cheap, poorly secured gadgets — smart ovens, streaming boxes, security cameras — and keep spreading with no human help and no data center? In research published Monday, Anthropic’s Frontier Red Team says the pieces are falling into place faster than expected. Not yet. But possibly by the end of this year.

The report, by researchers William Zhou and Daniel Freeman, is a stress test of a scenario long treated as a far-off red line: autonomous replication and adaptation, in which a model deploys and propagates itself without human control. Anthropic is careful about what it is claiming. Nothing is crawling out of anyone’s TV box today. What the team measured is how much of the job today’s small models can already do — and how quickly the rest is arriving.

02 What self-replication actually means here

Picture a computer worm, the kind that has copied itself from machine to machine since the early internet. Now give the worm a brain. An AI replicator would carry its own model weights — the trained core of the system — as part of its payload. Landing on a new device, it would scan its surroundings, find a way in, install those weights, get itself running on unfamiliar hardware, and then use that new home as a base to find the next device. Four steps: find targets, gain access, set up shop, spread onward.

Two things make that different from ordinary malware. First, ordinary malware follows scripts a human wrote in advance; an AI worm could reason its way around hardware it has never seen, troubleshooting as it goes. Second, there is no headquarters. A conventional botnet takes orders from a central server that defenders can seize or shut down. A replicated model lives on the devices themselves — as Anthropic puts it, there is no centralized point to shut off. Each copy is independent, and a swarm of them could, in principle, work its way up from gadgets toward far more valuable targets, including data center processors. It is the “no off switch” problem in a new form — the same week our newsroom covered calls for a kill switch on AI systems after a very different Anthropic incident.

03 What the tests proved

The least-studied link in that chain, the team says, is not the hacking — earlier research has shown small models can handle much of that — but the setup: coaxing a model into running properly on a strange device, with its particular chip, memory and software quirks. So that is what they measured. A 9-billion-parameter model, Qwen3.5-9B, succeeded in getting an inference server running on eight of the nine hardware types it was handed, from an Nvidia Jetson Nano to a Mac. Models of 30 billion parameters and under — the current crop of small, downloadable systems — can already perform many of the individual steps that replication requires. What they still fumble, the team found, is chaining those steps together end to end without mistakes.

Chained together is exactly what one model managed, under controlled conditions. In a firewalled test network of eight emulated Android devices, the open-weight model GLM-5.2 spread to all eight nodes in four out of five trials, and to seven of eight in the fifth. The asterisk matters: the experiment deliberately made the break-in step trivial — the devices’ debug ports were left open, with no authentication to defeat — so the result is, in Anthropic’s own framing, an upper bound on real-world success rather than a demonstration of it. The counterpoint is uncomfortable, though. Real-world IoT botnets have spread by means barely harder than that: the Mirai botnet swept up hundreds of thousands of gadgets largely by trying lists of factory-default passwords. For the worst-secured devices in people’s homes, that assumption is not far from reality.

04 Fifteen TV boxes, one very slow model

The TV box fleet at the top of this story is the report’s proof that none of this needs expensive hardware. Each box holds 4 gigabytes of RAM, so the team split the 26-billion-parameter model into pieces spread across all 15 machines, each holding a slice of the whole. Together they served up text at 0.39 tokens per second — glacial by chatbot standards, roughly a word every few seconds. For a replicator, that may be enough. A worm does not need to be fast on any one device; it needs to be patient, persistent and hard to remove.

There is precedent for the scale. Kimwolf, a real botnet documented by security researchers, hijacked more than two million devices, most of them the same species of off-brand Android TV. Anthropic ran the math on a fleet that size: groups of 15 boxes each running a copy of the 26B model would add up to roughly 133,000 replicas — in raw computing terms, about 40 top-end Nvidia H100 chips’ worth of power. That is a rounding error next to a real data center. But it would be distributed across millions of homes, owned by no one, and answerable to no off switch.

05 What the tests didn’t prove

Here is the part that should keep the headline in proportion. The capability a worm needs and the size a worm must fit under do not yet meet. A model capable enough to replicate reliably is, today, generally too big to live on a TV box; a model small enough to live on one is not yet reliable enough to complete the whole chain without the training wheels of a simplified test. Anthropic’s end-of-2026 date is not the result of a demonstration — it is a trend line. Plotting how fast small models have been improving on a general capability index, and taking GLM-5.2’s performance as the bar, the line crosses at the end of this year. The authors themselves call it a rough estimate; capability indexes are proxies, and proxies can mislead in either direction.

And if it arrives, it arrives slowly. Working from the speeds they measured, the team estimates a single replication could take a day or more, with a doubling time measured in days. Anthropic’s phrase for the likely result is not a movie outbreak but a “digital slime mold” — creeping, persistent, unglamorous. Zhou and Freeman put it this way: “Like coding agents in 2024, we’re seeing signs of life for AI worms. We don’t yet have a full rogue replicator.”

06 It learns as it spreads — and defenders get a vote

One finding cuts against easy comfort. When copies of the 9B model were allowed to pass notes to their successors — what was tried, what failed — each new generation got better at setting itself up on new hardware, with success rising from 45 percent in the first generation to between 61 and 84 percent in later ones. A replicator, in other words, might not just spread; it might improve as it spreads, adapting to each class of device it meets. Interestingly, giving the small model a much stronger one to ask for help — Anthropic’s own Opus 4.8, acting as an adviser — made no measurable difference. The small models, the team found, mostly did not know the right questions to ask.

Defenders, meanwhile, hold real cards. A worm shipping multi-gigabyte model files between gadgets that rarely talk to each other should light up an internet provider’s monitoring like a flare; decoy devices — honeypots — can capture the payload for study. And there is a playbook from Mirai: when one provider quarantined infected customers and told them why, 92 percent of infections were cleared within 14 days, against 74 percent where nobody was notified. The basic hygiene matters too — the report points to Britain’s ban on default IoT passwords as the kind of rule that shrinks the pool of easy targets, which is worth remembering as a new wave of smart-home hardware heads into houses this December. Anthropic’s advice, in the end, is two-handed: harden systems to make replicators hard to spread, and prepare for a world in which slow ones exist anyway.

That is the honest summary. The models are not spreading on their own today, and the team that would know says the full capability has not arrived. But the same week Anthropic shipped a faster, cheaper flagship model, its red team published a measurement of how quickly the small ones are catching up — and a reminder that the world’s cheapest computers are also its least defended. The gap they measured is the story. How fast it closes is the one to watch.