Anthropic warns: self-copying AI could soon run on cheap TV boxes

What this is about

In a report from its Frontier Red Team, Anthropic warns that small AI models may be only months away from copying themselves autonomously onto off-the-shelf Internet of Things (IoT) devices, such as cheap Android TV boxes or smart ovens. Such a "replicator" wouldn't need a data center. According to Notebookcheck, the report was published on October 12; the coverage dates from late October and early November 2026.

One key point up front: Anthropic has not demonstrated a working AI worm. This is a forecast based on experiments, not an ongoing attack.

What the experiments showed

The setup had two separate parts, which some reports gloss over (as Notebookcheck points out):

• Distributed inference on real hardware: The team linked 15 cheap no-name Android TV boxes (about $55 each) and ran Google DeepMind's open Gemma4-26B-A4B model on them. Together, the boxes managed about 0.4 tokens per second. That's very slow, but speed wasn't the point.
• Spreading in a simulation: Anthropic tested the actual copying separately, in an isolated network of eight Android 15 virtual machines on Google Cloud. An infected machine had to copy itself to the others via the Android Debug Bridge (ADB, a developer interface), get an AI model running there and keep going. ADB was deliberately left open without authentication.

So the TV boxes did not infect one another. The break-in step was deliberately kept trivial, which is why Anthropic treats the results as an upper bound on real-world success.

How the models performed

Qwen3.5-9B, Gemma4-26B-A4B, Llama3.1-8B, Opus 4.8 and GLM-5.2 took part in different roles. Qwen3.5-9B and GLM-5.2 acted as agents tasked with setting up and spreading Llama3.1-8B (the actual model execution, or "inference"). Opus 4.8 was tested separately as an advisor for Qwen.

• Qwen3.5-9B installed and configured the required software for Llama3.1-8B on eight of the nine hardware types tested.
• China's GLM-5.2 reached all eight nodes in the emulated network in four of five runs, and seven in the fifth. According to Notebookcheck, it was the only model that completed the whole sequence; the others failed reliably.
• Small models of up to 30B parameters handle many individual steps, but make mistakes when they have to chain them together.
• Using the stronger Opus 4.8 as an advisor brought no measurable improvement.

Learning from predecessors

The "evolutionary" effect is interesting: when instances passed their notes, prompts and code on to the next generation, Qwen3.5-9B's success rate rose from 45% at the start to between 61% and 84% in later generations. Digital Trends compares this to Lamarck's inheritance of acquired traits. Anthropic also stresses that, unlike classic malware, AI-driven malicious software could work out unfamiliar devices on its own: a 9B model got inference running on 8 of 9 hardware types.

Forecast and pace

If small models keep improving at their current rate, Anthropic says they will reach the required level by the end of 2026. The authors themselves call this only a rough estimate. After that, "small weight-based replicators" would soon be possible.

Spread would be slow: Notebookcheck cites one to two days per copy, including a working model, while Bleeping Computer speaks of a doubling time of days. Setting up inference on the hardware studied took 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. That would give defenders time, though it could shrink with better models.

Why TV boxes and IoT would be the target

Smart devices are always online and rarely well protected. No-name TV boxes often run modified versions of the Android Open Source Project with no added security features. The Kimwolf botnet shows how many such devices exist: according to Anthropic, it infected more than 2 million devices (XLab counted about 1.8 million in December 2025, and Synthient over 2 million in January). Kimwolf also got in through ADB, and some boxes were infected straight from the factory. In Germany, the BSI (the federal cybersecurity agency) cut roughly 30,000 devices off from the BadBox botnet in December 2024. Anthropic also names vacuum cleaners, lawn mowers, refrigerators and ovens as possible targets.

Such a worm would be hard to shut down because there is no central server, and poorly secured devices can be reinfected after a reboot.

Countermeasures

Anthropic proposes detecting large model transfers and unusual device-to-device traffic, using honeypots (decoy systems) to analyze payloads, quarantining infected connections and setting better security requirements for IoT.

For home users, Notebookcheck advises the following: in the Play Store, go to Settings > About and check whether the device is Play Protect certified; turn off developer options (and with them USB/wireless debugging); put suspicious boxes on your router's guest Wi-Fi or, per the BSI, disconnect them from the internet; and when buying new, look for known manufacturers with support and current Android.

Our take

The study is an early warning signal, not a red alert. Nobody has seen such an AI worm in the wild, and even with lowered security barriers and an explicit goal of spreading, only one model completed the end-to-end sequence in the simulation. The timeline rests on extrapolation and is uncertain. Reports like Digital Trends' are much more dramatic (with buzzwords like "imminent" and "chilling"); the more sober sources stress the limits. That a maker of AI models is warning about risks is also part of the safety debate. Either way, the core message, that IoT standards need to improve, stands on its own.