Anthropic’s researchers say small AI models may be only months from copying themselves across cheap internet-connected gear, from off-brand Android TV boxes to smart ovens. The claim comes from a research post published on 12 October by William Zhou and Daniel Freeman, and the hedge is in its title: “may be capable.” The authors state plainly that no full rogue replicator exists today.
The post is easy to misread because it reports three different kinds of result.
The first is a hardware demo. The team bought 15 off-brand Android TV boxes at roughly $55 each, networked them, and split a 26-billion-parameter model (Gemma4-26B-A4B) across them at 0.39 tokens per second. That is slow, but it shows that junk hardware can host a capable model. The researchers built this themselves. No AI agent set it up.
The second result measures one step of the chain. Agents powered by open-weight models were asked to get Llama3.1-8B serving on machines they had never seen, from Jetson Nano boards to Macs and RTX 4090 graphics cards. Of the 9 hardware types tested, a 9-billion-parameter model managed to start serving on 8. Those runs used Memento, a harness Anthropic built on the open-source Pi coding agent, which restarts a fresh agent with the previous one’s notes. Each attempt got 1.5 hours and the total limit was 6 hours. The authors say Memento improves reliability and grants no new abilities.
The third result is the full chain, and it is where the qualifiers pile up. Anthropic built a firewalled network of eight Google Cloud machines running an Android 15 emulator. A seeded “worm” scanned for neighbors, entered through a debugging port with no password, set up Llama3.1-8B, and spawned a copy once the new server passed correctness and anti-cheating checks. Only GLM-5.2 completed this. It reached all eight machines in four of five trials and seven of eight in the fifth. The other models failed reliably.
Three details limit what that shows. The worm’s own model ran on a separate server because the emulated machines were too small, so the authors are assuming GLM-5.2’s skill could be packed into an 8-billion-parameter model. What got replicated was Llama3.1-8B, not the worm’s own model. And the break-in step was trivial by design, so the authors treat the result as a ceiling on what a real attack would achieve. They note that Mirai, an earlier botnet, spread using lists of factory-default passwords, so real devices may not be much harder.
A control run isolates where the difficulty sits. With inference setup replaced by a pre-written script, across a 17-machine network, many models handled the remaining command-line work. Even a 3-billion-parameter model reached about half the machines. Getting a model running on foreign hardware is the hard part.
The timeline in the post is the authors’ own projection. Open-weight models of 30 billion parameters or fewer have gained 13.7 points a year on the Epoch Capabilities Index (R-squared of 0.95). If GLM-5.2 marks the capability floor, extending that trend reaches its level in a small model by the end of 2026. The authors call it a rough estimate, since the index is a general proxy and not a measure of replication skill. Nothing in the post attaches a damages figure or any other timeline.
The Kimwolf botnet infected over two million devices at its peak, according to Synthient, mostly Android TV boxes. If each group of 15 boxes ran one copy of Gemma4-26B-A4B, Anthropic calculates about 133,000 replicas and roughly 80,000 tokens per second, at most about 40 H100 chips’ worth of inference. That is little power, and the replicas would be slow, taking an estimated 28 to 150 hours of compute per full inference setup on TV hardware, and a fleet with no central server leaves nothing to switch off. Their doubling time, the authors say, would be days.
Qwen3.5-9B instances that inherited notes from earlier copies lifted their setup success rate from 45% in the first generation to between 61% and 84% in later ones, across 20 lineages. But giving Qwen3.5-9B access to Opus 4.8 as an adviser did not measurably help, because small models did not know what to ask.
Defenders have a precedent. When an internet provider notified and quarantined Mirai-infected customers, 92% of infections cleared within 14 days, against 74% without notification. Moving multi-gigabyte model files would also show up on network monitors. These are tests run by the lab, on emulated devices, with open models rather than Claude. Whether any of it transfers to hardened real-world targets is untested.
For device makers, the finding with a deadline attached is the dull one: if the authors’ trend holds, the thing standing between a TV box and an autonomous worm is a factory-default password, and the UK has already made those non-compliant.
Based on Anthropic’s research post of 12 October 2026.
