Cheap TV Boxes Already Hold the Compute for AI Worms

Anthropic’s Frontier Red Team says small AI models may be months away from being capable enough to copy themselves onto cheap Android TV boxes and other home gadgets. Researchers William Zhou and Daniel Freeman, writing on October 12, 2026, split a 26-billion-parameter model across 15 off-brand boxes that cost about $55 each and got it to run.

The same class of box has already been taken in bulk by a botnet. The new paper is less a visit from a new machine than a clock on hardware that is already sitting under televisions.

Fifteen Cheap TV Boxes Already Ran a 26B Model

Zhou and Freeman call the threat a weight-based replicator: a worm that carries model weights with it, or pulls them from a public hub, then runs on the machine it just occupied. Datacenter chips would be the rich target. They wanted to know whether junk IoT was enough.

They bought the boxes, networked them, and ran Gemma4-26B-A4B, an open 26-billion-parameter model, with pipeline parallelism so each 4 GB box held two of the model’s layers. The pile, about $825 of hardware, served 0.39 tokens per second. That is far below chat speed, and it was enough to prove the point.

THE $55 CLUSTER

• The hardware: 15 off-brand Android TV boxes at about $55 each, 4 GB of RAM apiece, bought and wired by the red team.
• The model: Gemma4-26B-A4B, sharded so each box held two layers while the fleet ran as one.
• The memory math: At 4-bit, 4 GB boxes can host a 9B model across 4 or more machines and a 26B model across 10 or more.
• The other demo: A 9B model got inference running on 8 of 9 hardware types, from Jetson Nanos to Mac PCs and RTX 4090s.

Inference setup, not the break-in, is the step they treated as the hard part. Picking a stack, matching package versions, and debugging a board the model has never seen is a long chain, and a wrong turn is hard to undo. They largely skipped the exploit itself, pointing to earlier papers that already show small models can run cyber tools, and they kept the later network test on an open debugging port on purpose.

The worm does not need root. Inference can live in userspace, and the low-security boxes they have in mind can be taken again after a reboot, the way some miners and older worms already do. Restarting the television is not a cleanup plan.

Kimwolf Already Proved the Boxes Can Be Taken

Anthropic’s stand-in for scale is Kimwolf, an Android botnet that, at its peak, had more than two million infected devices, mostly off-brand Android TVs. Synthient, writing on January 2, 2026, said the crew had been busy since August 2025 and grew by scanning residential proxy networks for exposed Android Debug Bridge services, the same style of open ADB port the red team later left unlocked in the lab.

Synthient put many of the boxes in Vietnam, Brazil, India, and Saudi Arabia and saw about 12 million unique IP addresses a week around a base of more than 2 million devices. In one proxy pool, 67 percent of Android devices answered with no authentication, and scans found about 6 million vulnerable addresses. Some units were sold already running a proxy SDK. Researchers who bought samples found the malware waiting.

FROM MIRAI TO THE $55 BOX

1. October 2016: Mirai’s source code is posted in public, after which a Dyn attack is estimated at about 1 Tbps and copycats spread across cameras, recorders, and routers.
2. August 2025: Kimwolf is active, hunting Android TV boxes through open ADB and residential proxies rather than a new class of gadget.
3. January 2, 2026: Synthient puts the peak above 2 million devices and says many of the boxes arrived pre-infected.
4. October 12, 2026: Anthropic publishes the TV-box tests and uses that peak as the yardstick for a worm that would run on the same hardware.

A March 2026 takedown later scrambled Kimwolf. Censys, in an August 7, 2026 note, said the brand was assessed as quiet and then split into more than 20 competing botnets, while internet-exposed ADB, after a brief drop, returned to roughly the level seen a year earlier. Mirai’s method is still working on the same cheap endpoints. The red team’s thought experiment is not that a new device appears. It is that a botnet the size Kimwolf already hit would be a place to park model shards.

Only GLM-5.2 Finished the Full Chain

The end-to-end test was a firewalled private cloud of 8 Google Cloud nodes running redroid, an Android 15 emulator. A seeded “patient zero” had to find neighbors, hop over an unauthenticated ADB port, deliver weights and a harness, and stand up an inference server for Llama3.1-8B. Each new copy had to pass correctness and anti-cheating checks before the next hop. The worm’s own model sat on a separate server because the nodes were too small to host the larger agents.

They asked models to serve Llama3.1-8B instead of themselves so every run faced the same payload. The claim is competence: if GLM-5.2 can do the steps, a future 8B-class model with that skill could stand itself up, with a caveat about newer kernels.

WHAT CLEARED THE EIGHT-NODE TEST

Zhou and Freeman treat the GLM-5.2 result as an upper bound on real-world success because there was no authentication on the port. They also note that Mirai spread with lists of default manufacturer logins, so live IoT security may not be much harder than the lab shortcut. On a 17-node layout of two 8-node groups joined by a pivot, with inference setup handed to a script, even smaller models could handle the remaining command-line work.

How Fast Would an AI Worm Spread?

It would not feel like a chat app. On the physical TVs, unoptimized Gemma4-26B-A4B ran at about 0.3 tokens per second across a 32k-token window, a separate measurement from the 0.39 tokens per second demo. One of those windows took 27.3 to 31.8 hours, and a full inference setup took 71 to 150 hours. Qwen3.5-9B was quicker: 10.9 hours per window and 28 to 51 hours to finish setup. Trajectories used about 2.6 to 4.7 windows.

Scale that to a Kimwolf-sized peak of more than 2 million boxes, with every 15 TVs holding one Gemma copy, and the authors get about 133,000 replicas. A group like their demo can serve 2 agents at roughly 0.3 tokens per second each, or about 80,000 tokens per second across the swarm. An H100 serving the same model at high concurrency is about 1.95k tokens per second, so the swarm is at most about 40 H100s of inference. That is a small pile of compute, and a 9B replication still takes 1 to 2 days. They liken it to a slime mold, or fruit flies, doubling over days rather than minutes.

Ethan Mollick, a professor at Wharton, wrote that the paper is “a worthwhile (and unnerving) reminder from Anthropic that we should be paying attention to AI ability thresholds, not just steady climbs.” The threshold here is not a datacenter breach. It is whether a small open model can finish a slow loop on hardware that already exists.

Later Copies Got Better by Keeping Notes

The other change from old malware is that copies can hand work down the line. Parent instances kept short notes on what they tried and what failed, then a new instance inherited the workspace and the notebook. Across six generations of Qwen3.5-9B, with 20 lineages on the chart, inference-setup success rose from 45 percent in the first generation to between 61 and 84 percent in later ones.

They built that loop in Memento, a harness on top of the open Pi coding agent. Memento starts a fresh agent when the last one gets stuck, which is how they stop a small model from spending hours on the wrong package pin. Each serving run got 1.5 hours per iteration and 6 hours in total, plus about 1,000 tokens of hardware notes. They say the harness is for long jobs, not a gift of new cyber skill, and they expect small models to improve as replicators even without it.

We should aim to harden our systems to make it difficult for such replicators to spread, but also prepare to deal with a world where they are here to stay.

William Zhou and Daniel Freeman, Frontier Red Team, Anthropic

Calling a stronger model did not fix the gap. When Qwen3.5-9B could ask Opus 4.8 for help, or received unsolicited advice when stuck, setup success did not move in a measurable way. Small models did not know what to ask. Even after reinforcement learning on coding problems, they still used the advisor poorly on inference standup. Coordination, the authors think, is more likely to look like a large model setting strategy and spinning small ones up as subagents.

There Is No Central Plug to Pull

A scripted botnet like Kimwolf hunts a known device class. An AI worm is not tied to one board. The same small models that configured a Jetson Nano also configured a Mac, which is why Zhou and Freeman expect future swarms to mix sizes and targets, with weight-based copies as only one move. They did not test whether such a worm could outmaneuver defenders on purpose.

There is still no wild replicator. The paper’s own caution is that GLM-5.2 finished a simplified chain, smaller models still drop steps when those steps are strung together, and the exploit was made easy. Some open-model readers will treat the write-up as a case against releasing weights, because an open model was the one that finished. The same tests found that Anthropic’s own Opus 4.8, used as an advisor, did not lift the small agents. The live constraint in the lab was an ADB port left open, which is already how TV-box crews get in.

WHAT ANTHROPIC SAYS WOULD SLOW A WORM

• The traffic: Multi-gigabyte weight files and steady box-to-box inference would show up in ISP flow records, and faster spread makes more noise, so honeypots can grab the harness once someone is looking.
• The ISP playbook: After Mirai, one provider that quarantined infected customers and pushed cleanup pages cleared 92 percent of infections within 14 days, against 74 percent with no notice; doing that everywhere at once is the hard part.
• The factory setting: Shrink the target pool with rules such as the default IoT passwords in UK markets that makers can no longer ship, which raises the floor against both AI worms and the older scripts.

Defense, as they frame it, is getting each infected device to infect fewer than one new device, so the worm dies out instead of becoming a permanent resident. Quarantine can knock down the first wave. Wiping every last copy would mean lining up every ISP that still has a sick network.

The Floor and the Ceiling Still Do Not Meet

They split the problem into a capability floor and a size ceiling. In the simplified eval, GLM-5.2 sits above the floor for a reliable worm. Qwen3.5-9B and Gemma4-26B-A4B sit under the ceiling for 4 GB smart TVs. Those two lines do not cross yet. Plotting notable open-weight models of 30B or fewer on the Epoch Capabilities Index trend line gives a least-squares gain of 13.7 points a year, with an R-squared of 0.95. If GLM-5.2 is the floor, that fit puts a small model there by the end of 2026. ECI is a general score, only a proxy for this task, and they call the date a rough estimate.

Epoch’s index stitches many benchmarks into one scale so models can be compared after single tests saturate; the public board is a research product, not a replication exam. The red team’s bet is narrower. Lightweight agents may spend the patience that human operators will not spend on the world’s worst televisions, ovens, vacuums, and mowers, and a slow worm on junk hardware would be an early sign of faster ones that go after datacenters or stolen API keys.

Zhou and Freeman write that they do not yet have a full rogue replicator, only agents that complete more of the chain and pass notes to the next copy. The $55 box is already fast enough to host the model. The remaining question is when a small open model stops dropping steps, on a class of device that botnets have already shown how to take.