Anthropic’s Frontier Red Team has stated that compact AI models may be only months away from copying themselves across cheap, internet-connected household gadgets, with no data center involved. The researchers have warned that this scenario will prove to be very difficult to control, as the models will be hard to shut down since nothing central controls them.
The research article was published on October 12 on Anthropic’s website, and is a concern for anyone running smart appliances at home or in a small business.
Fifteen cheap TV boxes, one 26-billion-parameter model
Researchers William Zhou and Daniel Freeman demonstrated the potential risk by linking 15 off-brand Android TV boxes to run Gemma4-26B-A4B, a model with 26 billion parameters. Each box cost about $55 and came with 4GB of RAM. The researchers distributed the model’s layers across the devices using a technique known as pipeline parallelism.
This collection of 15 different Android box devices altogether produced only 0.39 tokens per second, making it too slow for any sort of practical chatbot use. However, the researchers argued that a self-spreading worm does not necessarily need to operate at a high speed on a single machine, and would in fact benefit more from reaching a large number of devices.
They also pointed to Kimwolf, a botnet that infected more than two million mostly off-brand Android TVs, as an example of how many poorly secured devices are sitting ducks in people’s homes.
None of the models tested could reliably replicate itself on another device while remaining small enough to run on a smart TV. The researchers expect that gap to close by the end of 2026 if lightweight open models continue to advance at their current pace.
Replication in four steps, and one model that made it
Anthropic has divided the replication process into four different stages. These include identifying targets, gaining the ability to execute code, configuring inference and then repeating the process from each newly infected device.
The researchers largely set aside the initial hacking steps, pointing to earlier work showing that small models can already carry out cyber exploits. Instead, they focused on the third stage of configuring inference, which involves a lengthy series of hardware-specific decisions.
To test the entire process, the researchers set up an isolated network of eight Google Cloud nodes, each running an Android emulator. A preloaded worm spread between nodes through an unsecured Android Debug Bridge port before setting up a server to run Llama3.1-8B. Among the open-weight models tested, only GLM-5.2, developed by China’s Z.ai, completed the full replication cycle, reaching all eight nodes in four of the five runs.
The models became more successful at setting themselves up as they spread across generations. When instances of the 9-billion-parameter Qwen3.5-9B model passed setup notes to their successors, the success rate increased from 45% in the first generation to between 61% and 84% in subsequent generations.
Anthropic explains why a decentralized worm is hard to kill
Raw speed is not the main concern in this scenario, as Anthropic has endeavored to explain. Anthropic estimates that configuring the 26B model across the TV boxes would take 71 to 150 hours. The greater risk is the persistence involved, since there is no central server or human operator to shut it down, the system could evade the usual ways of containing and disabling it.
Roman V. Yampolskiy, an AI and cybersecurity expert at the University of Louisville, said the findings were very important. Yampolskiy claimed AI-powered worms could go beyond traditional malware by reasoning about unfamiliar devices, adapting when an approach fails and continuing to spread without human intervention.
While he does not consider them an existential threat today, he warned that their development is concerning.
“Home and small business IoT devices might be the first target for such attacks because they’re connected to the internet and, historically, have had minimal security measures in place,” Zhou and Freeman wrote in the Anthropic article.
Defenders still have an edge
Anthropic has likened the defense to the containment of an outbreak, with the goal of keeping the average number of new infections caused by each device below one. Internet providers could flag unusually large model transfers or persistent communication between devices, while honeypots could be used to capture a worm’s code.
The report cites the UK’s ban on default passwords for smart devices as a good way to reduce the number of vulnerable devices available to attackers.
Anthropic also stated that it still has not observed a functioning rogue replicator yet, and described current evidence only as “signs of life.” The company published the research alongside a separate claim that new safeguards had reduced distillation by 90 to 99%.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.