The replicator that would need fifteen TV boxes

Small AI models may be months away from being able to copy themselves across cheap internet-connected devices such as off-brand Android TV boxes, with no data centre involved, according to a research post published on Monday by William Zhou and Daniel Freeman of Anthropic's Frontier Red Team. The authors write that such a replicator "would be challenging to shut down, since there's no centralized point to shut off", though it may be slow, "with a doubling time of days". They also say no complete rogue replicator exists yet.

The post splits autonomous replication into four stages: finding targets, gaining execution on a device, getting a model running on it, and spreading from the new host. The authors largely set aside the break-in stages, citing earlier research, and test the other two. In a demonstration, the team bought 15 off-brand Android TV boxes at about $55 each, each with 4GB of memory, and ran a 26-billion-parameter open-weight model, Gemma4-26B-A4B, split across them at 0.39 tokens per second. Separately, a 9-billion-parameter model got inference running on eight of the nine hardware types tested.

The end-to-end result comes from a closed network. In a firewalled cloud network of eight nodes running an Android emulator, each reachable through an unauthenticated debug port, models were asked to spread and stand up a small stand-in model, Llama3.1-8B, on each node. Of the open-weight models tested, only GLM-5.2 completed full replication, reaching all eight nodes in four of five trials and seven in the fifth; the others "fail reliably", the post says. Models of 30 billion parameters or fewer can complete many individual steps, the authors write, but make mistakes when chaining them.

The authors are explicit that the test flatters the attacker. Keeping the break-in trivial "makes this an upper bound on real-world success", the post says, though it notes that the Mirai botnet spread by trying lists of default manufacturer passwords. The timeline is a projection: fitting a trend of about 13.7 points a year on the Epoch Capabilities Index, which the authors call only a proxy for replication ability, they estimate that a small model could reach GLM-5.2's level by the end of 2026. SecurityWeek reported the findings the following day.

The spread estimate is anchored on Kimwolf, a botnet that infected more than two million devices, mostly Android TV boxes, according to figures from Synthient cited in the post. If every group of 15 such boxes ran one copy of the 26-billion-parameter model, the post estimates about 133,000 replicas, which by our arithmetic matches two million divided by 15. Their combined computing power would be at most about 40 Nvidia H100 chips, and each replication of a 9-billion-parameter model would take more than a day. The authors say the estimate rests on one class of hardware and one past botnet.

The post also reports what did not work. Giving a small model, Qwen3.5-9B, access to a stronger adviser, Anthropic's own Claude Opus 4.8, produced no significant improvement, because small models "tend to not know the right questions to ask", the authors write. Notes passed between generations of the same small model did help: setup success rose from 45 per cent in the first generation to between 61 and 84 per cent in later ones. The authors also found small models weak at spear-phishing and expect social engineering to be done mostly by larger models.

The recommendations are aimed at network operators and device makers. The authors suggest that internet providers watch flow data for multi-gigabyte model payloads and sustained device-to-device traffic, that defenders use decoy devices to capture a replicator's code, and that infected subscribers be quarantined and notified. For the last, they cite a Mirai clean-up in which quarantine with notification cleared 92 per cent of infections within 14 days, against 74 per cent without notification, an 18-point gap by our subtraction. They also point to the UK's ban on default IoT passwords and to the aim of driving each infection's onward spread below one.

The work is one company's safety team publishing its own tests and its own forecast, and Komposite has not seen independent replication of the GLM-5.2 result. Anthropic develops frontier models itself, and the post lists large closed-weight models among the possible replicators it did not test. What the post establishes, on its own account, is that the separate steps are within reach of models small enough to run on hardware of this kind.

The practical defences are familiar ones: closed ports, no default credentials and monitored traffic. Komposite reported last month that Anthropic published the misuse it had blocked, and earlier this month that two developers were holding back open weights until after red-teaming; the release of small open-weight models is the variable this research turns on.