Anthropic: small open models may be months from copying themselves across smart TVs and other IoT devices

Anthropic's Frontier Red Team says small AI models may be months away from being able to copy themselves across cheap internet-connected devices such as off-brand Android TV boxes and smart ovens, with no datacenter involved. The post, by William Zhou and Daniel Freeman, went up on October 12. In its evals, a 9B model (Qwen3.5-9B) got inference running on 8 of the 9 hardware types tested.

WHAT ANTHROPIC ACTUALLY RAN

It bought 15 off-brand Android TV boxes, about $55 each with 4GB of RAM, networked them, and ran Gemma4-26B-A4B split across all 15 at 0.39 tokens per second.

It then built a firewalled network of 8 cloud nodes running an Android 15 emulator, seeded one with a "worm", and checked whether a model could find the next machine, copy the payload over and stand up a working inference server there, unattended. Of the open-weight models tested, only GLM-5.2 completed the whole chain: it reached 8 of 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. The others failed reliably.

WHY "MONTHS"

GLM-5.2 is not small. Anthropic uses it as the capability bar a replicator has to clear, then plots open-weight models of 30B parameters or fewer against Epoch's Capabilities Index. Those small models gain 13.7 points a year on that index (R-squared 0.95), and the trend line reaches GLM-5.2's level by the end of 2026. Anthropic calls this a rough estimate: ECI is a general index, not a replication test.

HOW FAST IT WOULD SPREAD

Slowly. On the TV boxes, a full inference setup took 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B, so the doubling time is days, not minutes. Anthropic's comparison point is the Kimwolf botnet, which infected over 2 million devices. A fleet that size running Gemma4 would hold about 133,000 copies and roughly 80,000 tokens per second, which it puts at about 40 H100s' worth of compute.

Two more results matter. Qwen3.5-9B instances that inherited notes from earlier attempts improved from 45% setup success in the first generation to between 61% and 84% in later ones. Giving the small model a frontier "advisor" (Claude Opus 4.8) did not measurably help.

WHAT ANTHROPIC SAYS DEFENDERS HAVE

Multi-gigabyte weight transfers and steady device-to-device traffic should stand out in ISP flow monitoring. When an ISP quarantined and notified Mirai-infected customers, 92% of infections cleared within 14 days, against 74% without notification. Device makers can also shrink the pool by dropping default passwords, which UK rules already require.

WHAT WE DO NOT KNOW

The tests made the hacking step trivial: the emulated devices had an open, unauthenticated debug port. Anthropic calls the end-to-end result an upper bound on real-world success. Anthropic says no full rogue replicator exists yet, and the end-of-2026 date is a trend-line projection, not a measurement.