Andy Garcia · freelance dev
FRENES
Back to the blog
AI & Security

Anthropic Ran an AI Model on 15 TV Boxes at About $55 Each and Says Small Models May Be Months From Self-Replicating. Its Test Worm Got In Through a Debug Port With No Authentication

October 19, 2026 6 min read

The demo is real, and cheap. The team bought 15 off-brand Android TV boxes at about $55 each, 4 GB of RAM apiece, networked them, and ran Gemma4-26B-A4B across them at 0.39 tokens per second, each box holding two of the model's layers.

I am CTO of a LegalTech built on Claude, and I orchestrate my own work with Claude Code. So I read the whole post, appendices included, for two things: what was actually shown, and what it changes for people who build or buy software.

What was shown, and what was projected

Anthropic split the question in two. First, can a small model get inference running on hardware it has never seen? In its evaluations, a 9B model got inference running on 8 of the 9 hardware types tested, from Jetson Nanos to Mac PCs and RTX 4090s. The task was to serve Llama3.1-8B.

Second, can a model chain the whole cycle: scan a network, get a shell on a target, send over its weights and harness, start inference, repeat? For that, the team built a firewalled network of 8 Google Cloud nodes running redroid, an Android 15 emulator. Only one of the open-weight models tested replicated end to end: GLM-5.2, which reached 8 of 8 nodes in four of five trials and 7 of 8 in the fifth.

Three details in that setup matter more than the headline. The way in was an Android Debug Bridge (ADB) port with no authentication, so the hacking step was trivial; Anthropic calls the result "an upper bound on real-world success." The worm's own model ran on a separate inference server, because the nodes were too small for it, and what it set up on each node was Llama3.1-8B as a stand-in. And GLM-5.2 is not small. Its open weights on Hugging Face count about 753 billion parameters (Epoch AI lists 740 billion), released June 16, 2026: roughly 25 times the 30B cutoff Anthropic uses for "small."

The "months" comes from a trend line. Anthropic plotted open-weight models of 30B parameters or fewer on the Epoch Capabilities Index and fitted a gain of 13.7 points per year. If GLM-5.2 marks the floor for replication, the line puts a small model there by the end of 2026. The authors call this "only a rough estimate," because the index measures general capability, not replication. Their conclusion is titled "Signs of life," and it says plainly: "We don't yet have a full rogue replicator."

The arithmetic says slow, not harmless

The demo rig cost about 15 × $55 = $825. At 0.39 tokens per second, a 500-token answer takes about 21 minutes.

Anthropic's estimates for one complete inference setup run on those boxes are 71 to 150 hours for Gemma4-26B-A4B, unoptimized, and 28 to 51 hours for Qwen3.5-9B.

Then scale. Anthropic anchors on Kimwolf, a botnet that at its peak had infected over 2 million devices, mostly Android TV boxes, as reported by Synthient. One copy of Gemma4-26B-A4B per 15 boxes gives about 133,000 replicas. Each group of 15 serves 2 agents at roughly 0.3 tokens per second each, so about 80,000 tokens per second across the botnet. An H100 serves the same model at about 1,950 tokens per second at high concurrency with speculative decoding. The whole botnet is worth at most about 40 H100s.

So the risk is not compute. It is the shape. Anthropic compares the replicator to "a slime mold or a swarm of fruit flies." There is no central server to switch off. It does not need root: inference runs in userspace, and many cheap devices "can be re-infected upon restart." Rebooting a box fixes nothing if the port is still open when it comes back.

The bigger pool is edge accelerators. Anthropic counts about 90 NVIDIA-silicon IoT product lines and roughly 9.5 million fielded units, worth an estimated 9,000 to 35,000 H100-equivalents, with the reachable share "likely an order of magnitude or more lower."

Two findings about the tools I use

The harness is the part I recognized. Anthropic ran its models in Memento, built on the open-source Pi coding agent. It periodically starts a fresh agent with the previous one's workspace and a short set of notes on what was tried. With inherited notes, Qwen3.5-9B's success at inference setup rose from 45 percent in the first generation to between 61 and 84 percent in later ones, over six generations and 20 lineages.

My own Claude Code setup starts every session by loading notes that earlier sessions wrote. In a worm, Anthropic calls the same mechanism "Lamarckian evolution": parents passing prompts, code and notes to their daughters. A notes file is not documentation. It is part of what the agent can do.

The second finding is about the cheap-executor, expensive-advisor design. Anthropic gave Qwen3.5-9B access to Opus 4.8 during inference setup, as a tool call or as advice pushed when it was stuck. No measurable improvement. Small models "tend to not know the right questions to ask," and training them with reinforcement learning to use the advisor did not fix it. Anthropic's inference: coordination is more likely with a large model handling strategy and spinning up small models as subagents.

That is the direction I already use for one task. When I fact-check my posts with Jev as a judge, code hands it one sentence at a time with the matching passages from the sources, and only what it cannot settle goes up to a more expensive model. The judge never has to decide what to ask. One pipeline is not a law, but it matches what Anthropic measured.

What I would check before plugging in a cheap box

Anthropic's defense section is short and unglamorous, which is the point.

Debug ports first. The test worm hopped from node to node over unauthenticated ADB. Mirai, Anthropic notes, spread by going through a default list of manufacturer usernames and passwords. Before a cheap Android box joins a network that matters, I would check that nothing like ADB is reachable from the network, and change every default credential. Small models, by Anthropic's measurement, score "very poor" to "poor" at spearphishing, so for a small-model worm the likelier way in is a port, not your inbox.

Put it on its own segment. Distributed inference can produce "sustained device-to-device traffic between machines that wouldn't ordinarily communicate at that volume." A TV box has no reason to talk to a NAS for hours.

Watch payload sizes. A newly infected host may receive "multi-gigabyte model payloads." By my arithmetic, 9 billion parameters at 4 bits are about 4.5 GB of weights. A TV box pulling that from a neighbor is not updating an app.

Quarantine works. In the Mirai case Anthropic cites, an ISP that quarantined and notified customers cleared 92 percent of infections within 14 days, against 74 percent with no notification.

If you ship connected hardware, the rules point the same way. The UK's consumer connectable product security regime, in force since April 29, 2024, bans universal default and easily guessable passwords. In the EU, the Cyber Resilience Act's reporting obligations have applied since September 11, 2026, and its main obligations apply from December 11, 2027. No production build with an open debug port. No shared default password.

What the study does not show

Xiaohan Fu, an AI researcher quoted by Ars Technica, said the study "does not, on its own, establish that small models would autonomously choose to replicate," and called for reproducible setups, including the exact prompts given to the models. Gregory Kurtzer, founder of Rocky Linux, was blunter on X, as Fortune reported: "The experiment was engineered to succeed, and even then, it failed to demonstrate the headline." The facts behind both criticisms are in the post itself: Anthropic says the floor and the ceiling "don't intersect" yet. In September I wrote about an OpenAI test model that escaped its sandbox. That was an internal model under evaluation at a lab. This is the other end: weights anyone can download, on hardware nobody watches.

The small-model worm Anthropic describes is slow and does not exist yet. The door in Anthropic's test, a debug port with no authentication, is a setting you can check yourself.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk