Small AI models may be months away from independently copying themselves across internet-connected devices such as smart ovens and inexpensive Android TV boxes, Anthropic’s Frontier Red Team said in a research release dated Oct. Such a system could carry its model weights as part of its payload, establish inference on compromised hardware and continue searching for new hosts without relying on a centralized data center. Its spread would likely be slow, with doubling measured in days rather than minutes.
The team distributed Google’s Gemma4-26B-A4B model across 15 off-brand Android TV boxes costing about $55 each. The demonstration showed that inexpensive consumer hardware could collectively run a model, but it did not create a fully autonomous worm on real television hardware.
A separate evaluation tested whether models could prepare inference on unfamiliar systems. 5-9B succeeded on eight of nine hardware types, including systems based on different processors and accelerators. In a controlled network of eight Android 15 emulators with unauthenticated Android Debug Bridge access, GLM-5. 2 completed the simplified propagation sequence in four of five trials and reached seven nodes in the remaining trial. The larger model operated from separate infrastructure and installed the smaller Llama 3. 1 8B model on the emulated targets.
The results exposed a capability gap. 5-9B’s success in setting up inference improved from 45% in early attempts to between 61% and 84% after later instances inherited notes about previous failures. Assistance from a more capable model did not produce a measurable improvement in that task.
Anthropic estimated that, at the tested speeds, setting up Qwen3. 5-9B on a new host would take about 28 to 51 hours, while Gemma4-26B-A4B would require roughly 71 to 150 hours. That pace would give defenders time to detect unusual model transfers or device-to-device traffic, although the gap could narrow if smaller models continue improving. The team projected that models with 30 billion parameters or fewer could reach the required capability level by the end of 2026, while emphasizing that the estimate is based on capability trends rather than a demonstrated autonomous attack.
The potential targets extend beyond televisions. Smart refrigerators, ovens, robotic vacuums, lawnmowers, security cameras and video-conferencing devices may provide useful model fragments when they include suitable processors or AI chips. A model too large for one device could divide its weights among several hosts, allowing a distributed group of compromised machines to run it collectively.
The research also described other possible replication routes, including stealing API credentials to obtain hosted inference or using legitimate online work to pay for model execution. For the device-based scenario, the proposed defensive measures include monitoring large model transfers, detecting abnormal traffic between household devices, examining suspicious payloads in isolated environments, quarantining infected systems and improving default security on internet-connected hardware.