Anthropic: Self-copying AI could soon target cheap TV boxes

Running a capable AI model used to take a data center. Anthropic has now shown that it also works on hardware many people already own. The company's Frontier Red Team linked 15 inexpensive off-brand Android TV boxes, at about $55 each, and ran the open Gemma 4 model with 26 billion parameters across them. The result was slow, with the boxes producing roughly 0.4 tokens per second between them. Speed was not what the researchers were measuring. They wanted to know how close small AI models are to copying themselves from device to device like a computer worm. The report published on October 12 says it could be a matter of months.

What the experiment showed

One detail gets lost in a lot of the coverage. The TV boxes only ran the model, and they did not infect each other. Anthropic tested the spreading part separately, on an isolated network of eight virtual Android 15 machines on Google Cloud. A first infected machine had to copy itself to the others over the Android Debug Bridge (ADB), get an AI model running on each one and carry on from there. ADB is a developer interface, and in the test it was open without any authentication.

Only one model managed the full run. GLM-5.2 from China, the predecessor of the model that recently built a Chrome exploit for $20, reached all eight machines in four of five runs and seven in the fifth. Other open models failed consistently. Smaller models with up to 30 billion parameters can already handle many of the individual steps, but Anthropic found that they make mistakes when they have to chain those steps together. They do improve over time. When each generation passed its notes on to the next, the setup success rate of Qwen3.5, a model with 9 billion parameters, rose from 45% to between 61% and 84%.

Anthropic is careful about what this means. The break-in step over the open ADB port was deliberately kept trivial, so the company describes the results as an upper bound on real-world success. The forecast that small models will reach this level by the end of 2026 is based on how quickly open models have improved so far, and the authors call it only a rough estimate. A worm like this would also be slow, since the researchers expect one to two days for each copy, including a working model.

Why cheap TV boxes are the likely target

Anthropic sees smart home devices as the probable first target because they are always online and rarely well protected. Off-brand TV boxes add another problem, since they usually run modified versions of the Android Open Source Project to which the manufacturers add no security features of their own. The Kimwolf botnet shows how many of these devices are out there. According to Anthropic, it infected more than 2 million devices, mostly off-brand Android TV boxes. Researchers at XLab counted about 1.8 million infected devices in December 2025, and Synthient put the figure above 2 million in January. Kimwolf also got in through ADB, and according to the analyses some boxes came with the unwanted software already installed at the factory.

Germany has these devices too. In December 2024, the country's cybersecurity agency BSI cut off about 30,000 devices from the BadBox malware, which came preinstalled on media players, digital photo frames and TV boxes. The agency said the real number was likely much higher. The Vo1d botnet has also spread across TV boxes. An AI worm would run on the same kind of hardware. Anthropic writes that it would be hard to shut down, because there is no central server that authorities could take offline, and many poorly secured devices can be reinfected after a restart.

How to check your TV box

The quickest way to see whether your box is one of the risky devices is the Play Store. Open it, tap your profile icon, then Settings and About. On TVs, the option may be in a slightly different place depending on the interface. If the Play Protect certification entry says the device is not certified, Google has no record of it passing Android compatibility testing. Such devices may not get system updates and may be less secure. The FBI also lists boxes without the Play Store, or with apps from unofficial stores that promise free streaming, as warning signs.

Next, look at the developer options. Depending on the interface, they are under System or Device Preferences. If the menu is missing, they have not been turned on. If it is there, switch off the main toggle at the top, which also disables USB and wireless debugging. That still does not make an off-brand box fully safe, because some ship with ADB open or with malware already installed. Put such devices on your router's guest network so they cannot reach your laptop or phone. If a box seems suspicious, the BSI advises disconnecting it from the internet and no longer using it.

For your next purchase, the BSI recommends a known manufacturer with official support and a current Android version, and installing security updates promptly. There is no reason to panic. Nobody has seen an AI worm like this in the wild yet, and Anthropic describes a forecast, not an ongoing attack. Anyone who already runs an AI model offline on a laptop knows how quickly small models are catching up, though. The cheap box under the TV is worth checking.

I write about IT security and artificial intelligence. Cybersecurity is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I have worked hands-on with AI for years, most recently with a focus on AI agents and their use in everyday work, and I test tools and models myself rather than just reading about them.