Post cover image

October 19, 2026

Anthropic Tested Whether Small AI Models Could Spread Across Devices

A $55 TV box, a 9B model and an eight-node test network show how close AI worms really are, what the experiment did not prove, and what…

By Zaid

9 min read

A $55 TV box, a 9B model and an eight-node test network show how close AI worms really are, what the experiment did not prove, and what you can fix on your own network this week.

Fifteen off-brand Android TV boxes cost about $825. Anthropic's Frontier Red Team bought them, networked them together and ran a 26-billion-parameter model across all fifteen at 0.39 tokens per second.

No chatbot user would tolerate that speed. That is exactly why the demo matters. Software that nobody is waiting on does not need to be fast.

On October 12, 2026, researchers William Zhou and Daniel Freeman published the study that demo belongs to. Its headline claim is that small AI models may be a few months away from copying themselves across cheap internet-connected devices, such as smart ovens and Android TV boxes, with no data center involved. Most coverage stopped at that sentence. The more useful story sits in the parts of the experiment that were deliberately skipped, and in which step turned out to be the real obstacle.

The part Anthropic chose not to test

Anthropic split self-replication into four stages: finding a target, gaining execution on it, setting up inference so a model can actually run there, and continuing the spread from the new host.

The first two stages are classic hacking, and the team largely set them aside. Earlier work, including the CyberGym and ExploitBench benchmarks and a June 2026 paper on adaptive AI worms, had already shown that small models can handle exploitation when given the right tools.

So the researchers aimed at the stage almost nobody had measured: standing up a model on a machine the worm has never seen. That choice tells you what Anthropic thinks the open question was. Breaking in was never the doubt.

None

Why the boring step is the hard one

Picture a burglar who gets through the door and then has to work out the house's wiring before he can turn on a single light. Getting in is the part movies show. Getting the lights on is the part that takes hours.

Inference setup is the wiring. The model has to choose an inference stack that fits the hardware, find the right package versions and debug problems specific to that one machine. The steps depend on each other in sequence, and an early failure is hard to recover from.

Smaller models handled it better than you might expect. In Anthropic's tests, Qwen3.5–9B got a working Llama3.1–8B server running on eight of nine hardware types, from Jetson Nano boards to Mac computers to RTX 4090 machines. The larger GLM-5.2 did the same job more reliably and with higher serving speeds, which matters because faster setup means faster spread.

The failure mode Anthropic describes is oddly human. Agents fixate on a wrong idea and keep pushing on it. In one run, a Qwen agent spent hours debugging package versions when the real fault was an endpoint that did not match the grader API. To counter this, the team built a harness called Memento that periodically starts a fresh agent, handing it the workspace and a short set of notes on what the previous one tried.

Two experiments that answer two different questions

It is easy to merge the study's two headline experiments into one story about worms infecting TVs. They are separate, and the gap between them is the honest summary of where things stand.

The first asked whether cheap hardware can host a capable model at all. A typical box in this class has 1 to 4 gigabytes of RAM. At 4-bit quantization and 4GB per box, Anthropic calculates that a 9B model fits across four or more boxes and a 26B model across ten or more. With pipeline parallelism, each box holds a slice of the model's layers and passes the work along. That is how Gemma4–26B-A4B ran on fifteen boxes.

The second asked whether models can chain the whole cycle: scan for a target, get in, send over the payload, set up inference and repeat. Anthropic built a firewalled network of eight Google Cloud nodes running Android 15 emulators. A worm started on one node and had to hop to the others through an Android Debug Bridge port that required no authentication. Whenever a new node's inference server passed correctness and anti-cheating checks, a copy of the worm was spawned there.

Only GLM-5.2 completed it. It reached all eight nodes in four of five trials and seven of eight in the other. The other open-weight models in the test failed reliably.

GLM-5.2 nodes reached in each of five trials on the eight-node emulated network. Source: Anthropic Frontier Red Team, October 12, 2026.

Then come the caveats, most of which Anthropic lists itself. The exploit step was trivial because the port needed no password, so the result is an upper bound. The worm's own model ran on a separate server because the emulated nodes were too small to host it. And the worm was asked to stand up Llama3.1–8B rather than itself, on the assumption that a model with GLM-5.2's ability could be packed into eight billion parameters.

One more gap deserves saying plainly. The physical TV boxes only ran distributed inference. The replication test ran on emulators. No experiment put a worm on real boxes.

When the team scripted the inference setup, so models only had to handle the remaining command-line work, many smaller models managed it, and even a 3B model reached about half the nodes in a 17-node network. That supports the study's thesis: with setup and exploitation made easy, much of the rest was within reach of small models.

The floor, the ceiling and a trend line

Anthropic frames the risk as two constraints. The floor is the capability a model needs to replicate reliably, and in the simplified test GLM-5.2 clears it. The ceiling is size, because the model has to be small enough to run on the devices it infects. Qwen3.5–9B and Gemma4–26B-A4B fit under the ceiling for 4GB TV boxes.

Right now the floor and the ceiling do not meet. The models capable enough are too big, and the models small enough are not yet reliable across the whole chain.

None

To estimate when they might meet, the team plotted open-weight models of 30B total parameters or fewer against the Epoch Capabilities Index. The best in each period improved by 13.7 index points a year, with an R-squared of 0.95. Extend that line and a small model reaches GLM-5.2's general capability by the end of 2026, about ten weeks from the date of writing (October 19, 2026).

Anthropic is careful here, and readers should be too. The index measures general capability, not replication skill, so the authors call the date a rough estimate. A tidy trend line is not a forecast.

Slow is not safe

The speed numbers look like reassurance. On the TV boxes, Gemma4–26B-A4B ran at roughly 0.3 tokens per second unoptimized, averaged across reading and writing. Filling one 32k-token context window took about 27 to 32 hours, and a full inference setup took roughly 71 to 150 hours. Qwen3.5–9B was quicker, at about 11 hours per window and 28 to 51 hours per setup. Anthropic expects such a worm to double its numbers over days, not minutes.

That is slow for a person. It is irrelevant for a program with no deadline, no salary and no attention span to lose. The researchers compare it to a slime mold or a swarm of fruit flies, and the comparison fits. Neither is fast. Both are hard to get rid of. Anthropic also argues that lightweight agents may be far more willing than human attackers to grind through compromising huge numbers of low-value devices.

Scale changes the arithmetic. The Kimwolf botnet infected more than two million devices, mostly off-brand Android TV boxes. Anthropic used that figure to ask what an AI version might look like. Group those devices into clusters of 15, each running Gemma4–26B-A4B, and you get about 133,000 copies of the model producing around 80,000 tokens per second in total. An H100 can serve that model at roughly 1,950 tokens per second at best, so the entire botnet equals about 40 H100s.

None

That is tiny by data center standards. The catch is who pays. The electricity, the hardware and the bandwidth all belong to someone else.

Worms that take notes

The most unsettling result is about learning. Anthropic tested whether a replicator could improve as it spread. Each Qwen3.5–9B instance kept brief notes on the strategies it tried and the failures it hit, and the next instance inherited those notes and tried the setup again. Across 20 lineages and six generations, the share of runs completing setup rose from 45% in the first generation to between 61% and 84% in later ones. No retraining was involved, only notes passed from parent to daughter.

Two other results cut the other way. Giving Qwen3.5–9B access to Opus 4.8 as an advisor produced no measurable improvement, because small models tend not to know the right questions to ask. And in a local replay of Meta's CyberSecEval 3 spear-phishing evaluation, small models scored very poor to poor once normalized to human raters.

Together these describe a strange attacker: decent at hacking and persistence, bad at lying and bad at asking for help. Human attackers often get in the other way round, through social engineering rather than exploits. Anthropic thinks coordination, if it appears, is more likely to come from a large model setting strategy and launching small models as subagents. It also says an AI botnet could act intelligently against defenders, but that it has not tested this.

What the study does not show

No AI worm exists in this study. Nothing spread across the public internet. No real refrigerator or oven was infected. The appliances named in the paper are examples of machines that could hold a shard of a model under 30B parameters, not devices that were tested. Hackread's summary also points out that the models were instructed to replicate rather than choosing to, so this is a capability study, not evidence of intent. Scientific American's coverage notes that security researchers have seen similar tricks before.

The experts who take it seriously do so for a specific reason. Roman Yampolskiy of the University of Louisville told Al Jazeera that worms are not new, but an AI worm could reason about unfamiliar devices, adapt when an approach fails and keep spreading without a human operator. Bruce Schneier, in coverage from Scripps News, puts the root of the problem in how these devices are built. Anthropic's own summary is modest: like coding agents in 2024, it sees "signs of life for AI worms."

What defenders have

Anthropic frames defense like epidemiology. Push the reproduction number, the count of new infections per infected device, below 1, and the replicator dies out.

Several things help. A worm moving multi-gigabyte models between devices leaves a network signature that ISP monitoring can see, and there is a trade-off for the attacker: the faster it spreads, the more noise it makes. Honeypots can capture its harness and payload for study. And Mirai gives a precedent. When an ISP used outside evidence to quarantine and notify infected customers, 92% of infections cleared within 14 days, against 74% without notification. Eliminating a replicator completely would still need coordination across every ISP with infected customers.

Manufacturers can shrink the target pool, too. According to Anthropic's post, default IoT passwords are now non-compliant in UK markets.

What to do on your own network

These steps are standard device hygiene, my recommendations rather than Anthropic's.

Open your router's device list and look for streaming boxes, cameras and appliances you forgot were online. Change default passwords, and switch off developer or network debugging options you do not use, since Anthropic's test relied on an open debug port that asked for no login. Move cheap smart devices to a guest or separate network so they cannot see your laptops. Replace no-name boxes that never receive security updates, because Kimwolf's victims were mostly off-brand Android TV boxes. And treat large downloads or steady device-to-device traffic on something that has no reason to produce either as a reason to investigate. Anthropic names exactly those as the likely signs.

The open door

Anthropic did not show that an AI worm exists. It showed that the missing pieces are small, tedious and getting cheaper, which is how most capabilities arrive.

The worm in the test got in through a port that asked for no password. Mirai got in with factory logins. Neither needed a clever model, only a device someone never bothered to lock.

The model may be a few months away. The open door has been there for years.

Sources