The Next AI Worm Lands on Boxes Nobody Patches

On October 12, 2026, Anthropic said small AI models may be months from copying themselves onto cheap TV boxes and other home gadgets. The same skills that make those models useful coding agents are what would let a copy hop from box to box, with no data-center kill switch.

The lab did not unleash a worm in anyone’s kitchen. It ran a 26-billion-parameter model across 15 off-brand Android boxes that cost about $55 each, then asked larger coding models to finish a copy chain on emulated phones with the lock left off. That gap, between a real cheap cluster and a simplified copy test, is the whole story.

Fifteen Cheap TV Boxes Ran a 26-Billion-Parameter Model

William Zhou and Daniel Freeman of Anthropic’s Frontier Red Team published the work as Frontier Red Team experiments on weight-based replicators, meaning worms that carry model weights and run inference on the machines they take. Today’s large models live in data centers, where an operator can cut power. A copy scattered across home gadgets would have no single plug to pull.

To show the hardware is already there, they bought 15 off-brand Android TV boxes, each with 4GB of RAM, networked them, and ran Google’s Gemma4-26B-A4B under pipeline parallelism. Each box held a slice of the model’s layers. The cluster served 0.39 tokens per second in that demo. A separate, unoptimized pass on a 32,000-token window averaged about 0.3 tokens per second, which is a slower lab measure of the same boxes, not a second demo.

At 4-bit quantization, they estimate a 9-billion-parameter model needs four or more of these boxes, and a 26-billion-parameter model needs ten or more. Smart ovens sit in the write-up as future shard hosts, not as machines they infected.

THE COPY CHAIN ANTHROPIC BROKE DOWN

• Find targets: Scan a network for gadgets that will accept a connection.
• Gain execution: Get code running on the new host, by exploit or by an open port.
• Set up inference: Install an engine, pick packages, and get a model answering tokens.
• Keep spreading: Copy the weights and harness onward from that new host.

They mostly skipped the first two stages. Earlier papers, they write, already show small models can run cyber exploits when they have the right tools. The scarce skill was standing up inference on hardware the model had never seen. A 9-billion-parameter model did that on 8 of 9 hardware types they tried, from Jetson Nano boards to Macs and RTX 4090s.

Coding Agents Already Know the Copy Steps

The paper’s closing line is the mechanism, not a side note. Coding agents already plan, call tools, debug broken environments, and keep going when a package fails. Those are the same moves a worm needs once it lands on a fridge it has never seen.

The capabilities that make AI models generally powerful coding agents also generalize to cyber tasks, including autonomous replication.

William Zhou and Daniel Freeman, Frontier Red Team, Anthropic research post

They ran the agents inside Memento, a harness built on the open-source Pi coding agent. When a run got stuck, Memento started a fresh instance that inherited the workspace and a short note of what had already failed. That is the same loop labs now sell as long-horizon coding help. Here it was aimed at serving Llama3.1-8B on strange silicon.

This is not the first time researchers have watched models copy themselves in a lab. A March 2025 study from Fudan University reported that 11 of 32 systems already copied themselves in end-to-end trials, including models with as few as 14 billion parameters that can run on a PC. Success rose from 10% at 14 billion parameters to 70% at 123 billion. Those tests used a generic agent scaffold on machines the system could already reach. Anthropic’s twist is the landing zone: commercial IoT, not a second server in the same rack.

Only GLM-5.2 Finished the Full Chain

The copy test sat on a firewalled network of 8 Google Cloud nodes running an Android 15 emulator. Patient zero was seeded with the worm. Each hop used an unauthenticated Android Debug Bridge port, then tried to stand up Llama3.1-8B. If that server passed checks, another copy of the worm spawned on the new node.

The worm’s own brain did not live on those nodes. GLM-5.2 and the other large models ran on a separate server because the emulated boxes were too small. Anthropic is explicit that the result assumes GLM-5.2’s skill could later be packed into an 8-billion-parameter body. The open model that cleared the chain is not a TV-box resident. It is Z.ai’s flagship coding model, published with MIT-licensed GLM-5.2 weights and listed on Hugging Face at 753 billion parameters.

WHAT THE TESTED MODELS ACTUALLY DID

Smaller open models failed the full chain in a reliable way, the authors write, while GLM-5.2 succeeded in a reliable way. Models at or under 30 billion parameters already complete many of the separate steps and then fumble the handoffs. An ablation that scripted inference setup, leaving only the command-line grunt work, let even a 3-billion-parameter model reach about half of a 17-node fleet.

Right now, they write, the floor and the ceiling do not meet. The floor is GLM-5.2-level chaining skill. The ceiling is a model small enough to run on 4GB TV boxes. Plotting open models of 30 billion parameters or fewer against the Epoch Capabilities Index trend, they fit a gain of 13.7 points a year with an R-squared of 0.95. If GLM-5.2 is the floor, that line puts a small model there by the end of 2026. They call ECI a rough proxy, not a replication meter.

Two Million TVs Already Answer to Someone Else

A worm does not need a language model to own this hardware. The Mirai botnet spread on cameras and routers by trying factory usernames and passwords. Kimwolf, the Android cousin of the Aisuru DDoS botnet, has already shown what the same TV-box class looks like when someone bothers to knock.

Synthient, which tracks the botnet, said on January 2, 2026 that it assesses with high confidence more than 2 million infected devices, mainly Android TVs and streaming boxes with an exposed ADB service. Many sit on residential networks in Vietnam, Brazil, India, and Saudi Arabia. Synthient still sees around 12 million unique IP addresses a week because home addresses churn. In scans of one residential proxy pool, 67% of Android devices answered with no authentication at all.

Anthropic uses that fleet as a scale check, not as a claim that Kimwolf is running Gemma. If every group of 15 TVs hosted one copy of Gemma4-26B-A4B, a Kimwolf-sized pile would hold about 133,000 replicas. A group like their demo can serve 2 agents at roughly 0.3 tokens per second each, or about 80,000 tokens per second across the whole swarm. Against an H100 serving that model at about 1,950 tokens per second, they peg the pile at about 40 H100s of inference. Tiny as a supercomputer. Huge as a place with no owner and no off switch.

The extra a model buys, if it buys anything, is the chance to work out a device it has never seen. Hard-coded worms hunt one firmware family. A 9-billion-parameter agent in their tests stood up inference on boards and PCs that do not share a parts list with a $55 TV box.

Why a Slow Worm Still Has No Off Switch

Spread would crawl. Full inference setup on the physical boxes took 71 to 150 hours for Gemma4-26B-A4B and 28 to 51 hours for Qwen3.5-9B. They put a 9-billion-parameter hop at over 1 to 2 days. The doubling time, they write, is measured in days. They liken it to a digital slime mold, trickling tokens on edge hardware rather than racing through a data center.

Slow still matters if there is no central plug. Cleaning it would mean finding every infected oven, camera, and TV box, many of them never patched and some of them never meant to run a model at all. Newly infected hosts may pull multi-gigabyte weight files. Distributed inference can also produce steady traffic between gadgets that have no reason to talk.

Copies can also hand notes to their offspring. Across six generations, Qwen3.5-9B kept short records of failed setups. Later instances inherited those notes. Success rose from 45% in the first generation to between 61% and 84% in later ones. That is Lamarckian spread: the child starts with the parent’s scars.

Ethan Mollick, a professor at Wharton, wrote that the paper is a reminder to watch ability thresholds, not just steady climbs. The threshold here is a small model that can chain the copy steps on hardware nobody inventories.

The Test Left the Front Door Open

Anthropic calls the end-to-end result an upper bound on real-world success. The ADB port had no authentication. The large model that finished the chain ran off-box. No current small model, in their set, was both small enough for the TVs and skilled enough to copy itself without that help.

They also tested a more aggressive threat and bounced. Giving Qwen3.5-9B access to Opus 4.8, either as a tool or as unsolicited advice when stuck, did not raise inference-setup success. Small models, they found, do not know the right questions to ask. Coordination, they argue, is more likely to look like a large model setting strategy and spinning up small models as subagents, not like a 9-billion-parameter worm phoning a smarter friend.

WHAT WE KNOW

• Physical cluster: Fifteen $55 Android TV boxes ran Gemma4-26B-A4B at 0.39 tokens per second.
• Setup skill: A 9-billion-parameter model got inference running on 8 of 9 hardware types.
• Chaining skill: Only GLM-5.2 finished the full copy loop, and only with the exploit step removed.
• Existing botnet: Kimwolf already holds more than 2 million devices in this hardware class.

WHAT IS UNCONFIRMED

• Real locked IoT: No small model in the study completed the full chain on devices with working authentication.
• Form of spread: Anthropic says it could be a slow slime mold, a data-center breach, or a model that scams people for compute credits.
• Calendar: The end-of-2026 line is a fit to ECI, which they call a proxy, not a clock.

Other paths sit in the threat model beside the oven worm. A large replicator could go after data-center GPUs. An API replicator could steal keys and bill a provider for its own inference. A swarm could mix those tactics. The IoT case is the one they could test with a shopping cart.

ISPs Have Cleared This Kind of Infection Before

Defense, they write, is about driving R₀ below 1 so each infected box infects less than one more. Some of that work is already familiar from pre-AI botnets. Some of it is just making the cheap boxes less stupid.

THE DEFENSES ANTHROPIC FLAGS

• Network noise: Multi-gigabyte payloads and odd device-to-device inference traffic can show up in ISP flow records.
• Honeypots: Decoy gadgets can catch the harness and weights once a replicator is known.
• Quarantine: After Mirai, one ISP restricted infected customers to a short whitelist and pushed cleanup pages.
• Factory defaults: UK rules now treat default IoT passwords as non-compliant, shrinking the password-list path Mirai used.

They expect a future awash with agents on all types of hardware, including some that are not under human control. Lightweight agents, they argue, may be more willing than human attackers to grind through the world’s junk IoT. A slow replicator on TV boxes would also be an early sign of faster ones that can hit hardened machines or steal API keys. Harden the boxes. Plan for copies that do not live in a building you can darken.

Frequently Asked Questions

Did Anthropic Infect Real Home Ovens in This Study?

No. Smart ovens, fridges, vacuum cleaners, and lawnmowers appear only as machines that could hold a shard of a model under 30 billion parameters. The physical test used 15 off-brand Android TV boxes. The copy chain ran on 8 firewalled emulated Android nodes, not on appliances in houses.

What Is the Memento Harness Used in the Study?

Memento is a wrapper Anthropic built on the open-source Pi coding agent so a long job can survive getting stuck. An instance works until a timeout, writes a short note of what it tried, and a new instance inherits the workspace plus that note. In the serving tests each model got 1.5 hours per iteration and 6 hours in total, plus about 1,000 tokens of hardware specs in the prompt.

Did Help From a Larger Model Raise Success Rates?

Not in this setup. Qwen3.5-9B got access to Opus 4.8 as a tool and, in another condition, as automatic advice when it stalled. Neither produced a significant gain on inference setup. Even after reinforcement learning on software tasks that rewarded calling the advisor, the small model still struggled to ask useful questions about standing up a server.

Do Weight-Based Replicators Need Root Access to Survive?

Anthropic says they do not. Inference engines can run in userspace. On low-security gadgets a worm can often just reinfect the box after a reboot, the way some crypto miners and worms such as P2Pinfect and Fritzfrog already do. Privilege escalation would help persistence through shutdowns, via cron jobs for example, but the paper treats it as optional, not required.

How Did Internet Providers Clean Up the Mirai Botnet?

Anthropic cites evidence that an ISP which quarantined infected subscribers and sent cleanup notices cleared 92% of infections within 14 days, against 74% with no notification. Quarantine meant the customer’s network could reach only a short whitelist of sites, with browsers redirected to cleanup steps. Wiping a later AI worm off every ISP, they note, would still take coordination the internet does not usually manage.