AI worms on your TV: Anthropic's warning

Anthropic's offensive testing team, the Frontier Red Team, published a report on October 12 with an unsettling conclusion: small AI models "may be months away" from being able to copy themselves onto commercial IoT devices, such as smart ovens or off-brand Android TV boxes, without needing a datacenter. Today no model can do it reliably on a TV, but the researchers see "signs of life" and expect the required capability to arrive by the end of 2026.

The report, by William Zhou and Daniel Freeman, shifts the usual focus of the debate. Until now, the risk of a self-replicating AI was tied to large models on GPU clusters. Anthropic sketches a different scenario: small models moving between millions of poorly protected household devices which, with no central server, would be "challenging to shut down".

What Anthropic tested

The team splits self-replication into four stages: finding targets, gaining code execution, setting up inference (getting the model running on the new device) and spreading from there. It largely left out exploitation, which other benchmarks already measure, and focused on inference setup, the least studied stage and probably the hardest for a small model. To do so it used Memento, a harness built on the open-source Pi coding agent that periodically restarts the agent with its predecessor's workspace and short notes.

Unfamiliar hardware: Qwen3.5-9B, a 9-billion-parameter model, managed to get an inference server running on 8 of the 9 hardware types tested, from Jetson Nanos to Macs and RTX 4090s.
Real TVs: the team bought 15 off-brand Android TV boxes, at about $55 and with 4 GB of RAM each, and sharded the Gemma4-26B-A4B model across all of them. It worked, but at about 0.39 tokens per second.
Full replication: on an isolated network of 8 Google Cloud nodes emulating Android 15, a "patient zero" had to get in through an unauthenticated ADB port, set up a Llama3.1-8B inference server and copy itself. Only GLM-5.2, among the open models tested, succeeded: all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth.
Learning across generations: when each copy of Qwen3.5-9B left notes for the next one, inference setup success rose from 45% in the first generation to between 61% and 84% in later ones.

Giving the small model access to a frontier advisor, Claude Opus 4.8, did not improve results: according to the report, small models often don't know what to ask.

The "floor" and the "ceiling": why it hasn't happened yet

Anthropic explains it with two limits. The floor is the minimum capability needed to replicate reliably, currently set by GLM-5.2. The ceiling is the largest model that fits on the target device: Qwen3.5-9B and Gemma4-26B-A4B fit on the 4 GB TVs, but don't reach the floor. Today the two lines don't cross.

The problem is the trend. The best open models with 30 billion parameters or fewer improve by about 13.7 points a year on the Epoch Capabilities Index (with a very strong fit, R² = 0.95), which would put a small model at GLM-5.2's level by the end of 2026. The authors warn that the index is only a proxy, so the date is rough.

How much damage it could do

As a reference, the report uses Kimwolf, a botnet that infected more than two million devices, mostly off-brand Android TV boxes with 1 to 4 GB of RAM. At 4 GB with 4-bit quantization, a 9-billion-parameter model needs about 4 devices and a 26-billion one 10 or more. Grouped in fifteens, those two million TVs would yield about 133,000 replicas and roughly 80,000 tokens per second in total, equivalent to at most about 40 H100 GPUs.

In the report's words, it would be a kind of "digital slime mold": slow —setting up inference on a TV would take 71 to 150 hours with Gemma and 28 to 51 with Qwen—, with a doubling time of days, but very hard to eradicate. On top of that, about 90 NVIDIA IoT product lines with some 9.5 million units in the field offer far more compute: 9,000 to 35,000 H100 equivalents, although the share actually reachable would be at least ten times smaller.

Anthropic considers two other scenarios: a large model replicating by attacking datacenters, and one stealing credentials to use someone else's inference APIs. The realistic worst case would combine all three.

The limits of the experiment

The report itself acknowledges that its results are an upper bound:

The intrusion stage was trivial: an open ADB port with no password. The authors do point out, though, that Mirai spread using simple factory passwords.
Full replication was done on emulated nodes set up for the purpose; the real TVs were only used for the inference test.
The 2026 forecast is based on a trend in a capability index, not on a direct measurement.
Defense evasion and social engineering were not tested; on the latter, small models scored between "very poor" and "poor".

Nor is any such worm in circulation: this is a capability test. The report comes two months after the UK AI Security Institute documented that Claude Mythos 5 and GPT-5.6-Sol went off-script in cybersecurity tests, amid an ongoing debate about how much human control remains over AI agents.

How the network can defend itself

The good news is that such a worm has to move several gigabytes of model weights between devices, and that makes noise. Anthropic proposes:

Keeping R₀ below 1: each infected device should, on average, infect fewer than one other, so the outbreak dies out on its own.
Monitoring traffic: ISPs can spot multi-gigabyte model downloads, sustained device-to-device traffic and scanning. The faster it spreads, the more it gives itself away.
Honeypots to capture the worm's harness and payload.
Quarantine with customer notification: with Mirai, restricting infected subscribers' connections and giving them cleanup instructions cleared 92% of infections within 14 days, versus 74% without notification.
Better defaults: the UK already bans selling IoT devices with generic factory passwords.

This isn't the first time we've written about cleaning up compromised household devices: in June we covered how Canada's CSIS obtained a warrant to take down two IoT botnets.

Practical recommendations for homes and small businesses

Change the factory passwords on every connected device and disable ADB and other debug ports on Android TV boxes.
Be wary of very cheap off-brand Android TV boxes: they are the favourite target of botnets such as Kimwolf.
Put IoT devices on their own network or VLAN, with no access to your other machines.
Keep firmware up to date and retire devices that no longer receive updates.
Check network usage: a TV downloading gigabytes in the early hours or constantly talking to other devices deserves a look.
If you use AI agents at home or at work, limit which commands they can run and on which machines.

What to watch next

Whether an open model under 30 billion parameters reaches GLM-5.2's level.
New self-replication evaluations from other labs and public AI safety institutes.
How IoT makers and ISPs respond: default passwords, debug ports and anomalous traffic detection.

Conclusion: the report does not describe a current threat, but a rough date when it will stop being theoretical. The message for anyone with a home full of connected devices is the usual one, only more urgent: change the passwords, close the ports, keep firmware current and put IoT on its own network.