1. Home
2. News
3. Anthropic

Anthropic researchers say small AI models may be months from spreading across Android TV boxes

In their tests only GLM-5.2 spread through a whole network, but they expect a small model to match it by the end of 2026.

By Think Facility · October 13, 2026 · Anthropic AI safety Save

On October 12, 2026, two researchers on Anthropic's Frontier Red Team said small AI models may be only months away from copying themselves across cheap internet-connected devices. William Zhou and Daniel Freeman set out the tests in a post on Anthropic's research blog, naming smart ovens and off-brand Android TV boxes as the kind of hardware at risk.

They ran Gemma4-26B-A4B, an open-weight model, split across 15 Android TV boxes they bought for about $55 each. It managed 0.39 tokens per second.

What a worm like this would do

The worry is an AI version of a computer worm. It would carry its own model weights, break into a device, get the model running there, then look for the next device. Zhou and Freeman call these weight-based replicators.

They mostly left the hacking step aside, since earlier papers already show small models can write exploits. Their tests went at the step that's studied less: getting a model running on hardware the AI hasn't seen before.

Who

William Zhou and Daniel Freeman, Anthropic Frontier Red Team

Published

Oct 12, 2026

Demo

Gemma4-26B-A4B on 15 Android TV boxes

Inference setup

8 of the 9 hardware types

End to end

only GLM-5.2, 8/8 nodes in 4 out of 5 trials

What the tests found

A 9B model, Qwen3.5-9B, got inference running on 8 of the 9 hardware types they tried, from Jetson Nanos to Mac PCs. Then they built a firewalled network of 8 cloud machines running an Android emulator and dropped a worm on one of them.

Only GLM-5.2 spread through the whole network. It reached all 8 nodes in 4 of 5 trials, while the other open-weight models failed reliably. GLM-5.2 is too big for a TV box, though. The question is when a small model gets that good.

Their answer is a trend line. Plotting open-weight models of 30B parameters or less on the Epoch Capabilities Index, they get a small model at GLM-5.2's level by the end of 2026. They call it only a rough estimate.

How fast, and how big

Slow, by their numbers. Setting up inference would take Qwen3.5-9B 28 to 51 hours on TV-box hardware. The researchers compare it to a slime mold.

They size it against Kimwolf, a real botnet that infected more than 2 million devices, mostly Android TV boxes. A fleet that size running Gemma4-26B-A4B would add up to at most about 40 H100s' worth of inference. That's a tiny amount of compute. It's also spread across millions of homes, with no central point to switch off.

I'd note the caveat they put on their own result: the test network had no password on its ADB port, so the break-in step was trivial, which makes this an upper bound on real-world success. They also point out that Mirai, an older botnet, spread with nothing cleverer than default manufacturer passwords.

What they say defenders can do

A replicator pulling multi-gigabyte models onto home devices would show up in ISPs' traffic monitoring. When an ISP quarantined Mirai-infected customers and told them, 92% of infections were cleared within 14 days.

For manufacturers, the post points to the UK, where default IoT passwords are now non-compliant.