Anthropic: Small AI May Self-Replicate on $55 TV Boxes Within Months

Anthropic's Frontier Red Team says small AI models "may be months away from being capable enough to self-replicate" on cheap internet-connected gadgets such as off-brand Android TV boxes and smart ovens. The researchers ran a 26-billion-parameter model across 15 TV boxes costing about $55 each, at 0.39 tokens per second.

That headline needs careful reading. Anthropic says no full "rogue replicator" exists yet, and its test of a full replication cycle used cloud emulators with the hacking step made deliberately trivial. The "months away" part is a trend-line forecast, not something the team watched happen.

Based on Anthropic's research post by William Zhou and Daniel Freeman (October 12, 2026), Al Jazeera's coverage, and official IoT security guidance from the UK NCSC, US CISA and the UK government, checked October 13, 2026. We have not reproduced the experiments; all results and estimates are Anthropic's.

What Anthropic actually tested

The Anthropic research post splits self-replication into four stages: finding targets, gaining execution, getting a model running (inference), and spreading again from the new host. The team mostly skipped the first two, citing earlier work showing small models can already handle cyber exploits. Its focus was setting up a working model on unfamiliar hardware.

A 9B model "got inference running on 8 of the 9 hardware types" tested, and Qwen3.5-9B set up inference servers on hardware from Jetson Nano boards to Macs and RTX 4090 cards. Anthropic says models of 30B parameters and under "can already complete many of the individual steps" but "make mistakes when composing them end to end."

Separately, the researchers bought 15 Android TV boxes with 4GB of RAM each and split Gemma4-26B-A4B across them, two layers per box. That shows cheap devices can jointly run a fairly capable model. It is not a demonstration of a model spreading itself onto those boxes.

What "self-replicate" means in this setup

The end-to-end test used a firewalled network of 8 Google Cloud nodes running redroid, an Android 15 emulator. A "worm" agent started on one node and had to scan the network, hop to other nodes through an Android Debug Bridge (ADB) port with no authentication, copy its payload, and stand up a Llama3.1-8B inference server that passed correctness and anti-cheating checks.

Two details matter. The models set up Llama3.1-8B rather than themselves, to keep the comparison fair. And the worm's own model ran on a separate server, because the emulated nodes were too small. Only GLM-5.2 succeeded reliably, reaching all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth; the other open-weight models "fail reliably."

So the finding is that a model at GLM-5.2's capability level can do the replication steps. A small model with that capability, light enough for weak devices, does not yet exist. In the authors' words, the capability "floor" and device-size "ceiling" "don't intersect" right now.

Where "months away" comes from

The timeline is an extrapolation. Anthropic plotted open-weight models of 30B parameters or fewer against Epoch's Capabilities Index (ECI), a general benchmark score, and found the best gaining about 13.7 points a year (R² of 0.95). Taking GLM-5.2 as the bar, the trend line reaches it "by the end of 2026."

The researchers flag the weakness themselves: ECI "is only a proxy metric for replication ability, so this is only a rough estimate." Small replicators "may be possible soon after" a small model reaches that level.

Any such worm would also be slow. Anthropic estimates inference setup on the TV boxes would take 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for the 26B Gemma model. Scaled to Kimwolf, a past botnet of over 2 million mostly Android TV devices, it estimates "at most about 40 H100s-worth of inference."

The catch: a forecast, not a working worm

Anthropic is explicit: "We don't yet have a full rogue replicator." Its conclusion is titled "Signs of life." Limits the authors list include:

• The hacking step was trivial, "which makes this an upper bound on real-world success." They note the Mirai botnet spread using default passwords, so real IoT security "might not be dramatically more difficult."
• The full-cycle test ran on emulators, not physical consumer devices.
• Scale estimates rest on "a single class of IoT hardware and a single past botnet instance."
• They did not test whether an AI botnet could act intelligently against defenders.
• Advice from Anthropic's Opus 4.8 "doesn't measurably help" Qwen3.5-9B. But Qwen instances passing notes to successors raised setup success from 45% to between 61% and 84%.

Roman V Yampolskiy of the University of Louisville told Al Jazeera: "Today, this is not an existential threat. But the trajectory is concerning." Al Jazeera said Anthropic did not respond to its questions. We found no independent replication of the work yet.

What Anthropic recommends, and what you can do

Anthropic's defence advice targets internet providers, manufacturers and regulators. A model spreading across IoT devices would leave a signature: multi-gigabyte model downloads and sustained device-to-device traffic visible in ISP monitoring. The authors cite Mirai, where an ISP's quarantine-and-notify approach "cleared 92% of infections within 14 days, against 74% with no notification."

They also want manufacturers to "shrink the pool of targets" with safer defaults, citing the UK ban on default passwords. Under the UK product security regime, in force since April 29, 2024, passwords must be unique per product or set by the user, and makers must publish minimum security-update periods.

For households, the UK NCSC's smart devices guidance and US CISA's IoT security advice recommend:

• Change default passwords to strong ones. The NCSC suggests three random words.
• Turn on automatic updates and install manual ones when prompted.
• Switch off remote access you don't need, and ask whether a device needs to be online at all.
• Check support periods before buying, and avoid devices the maker no longer supports.
• Reset a device you think is compromised using the maker's instructions.

Anthropic tested cheap unbranded TV boxes; an old, never-updated one may not belong on your home network. For a different kind of self-propagating AI risk, see our report on the Copilot for Word AI worm.

Frequently asked questions

Has an AI actually copied itself onto someone's smart TV?

No. Anthropic writes that "we don't yet have a full rogue replicator," and none of the small models that fit on its TV boxes could reliably complete the full cycle. Its end-to-end test used cloud emulators with a deliberately easy entry point.

Why does Anthropic say "months away"?

Small open models have gained about 13.7 ECI points a year, and that trend reaches GLM-5.2's level by the end of 2026. The authors call this a rough estimate based on a general capability score, not a direct measure of replication ability.

Which devices are most at risk?

Anthropic's threat model centres on cheap, poorly secured IoT hardware, especially off-brand Android TV boxes running Android forks with few added security features. It also names smart fridges, ovens, robot vacuums and AI-equipped cameras as possible hosts.

This is a warning about direction, not a report of an attack. The practical response is the IoT hygiene security agencies have urged for years.