Anthropic tests small model across 15 TV boxes
Key takeaways
- Anthropic's Frontier Red Team ran Gemma4-26B-A4B across 15 off-brand Android TV boxes at 0.39 tokens per second using pipeline parallelism.
- GLM-5.2 reached all eight target nodes in four of five trials; smaller models set up inference on individual devices but did not complete full end-to-end replication.
- The authors estimate a Mirai-scale botnet could run roughly 133,000 concurrent copies of the 26B model.
Last updated: 12 October 2026
Small AI models may be months away from self-replicating across cheap consumer IoT devices without access to a data centre. That is the central claim from Anthropic's Frontier Red Team in a post published by William Zhou and Daniel Freeman.
The team tested whether models at 30 billion parameters or below could set up inference on unfamiliar hardware and chain the full replication cycle across a fleet of machines. The work shifts the autonomous replication debate away from GPU clusters and toward the millions of poorly defended consumer devices in homes.
What the TV box demo showed
The team ran Gemma4-26B-A4B across 15 off-brand Android TV boxes at roughly $55 each, networked together at 0.39 tokens per second. Two of the model's layers were held on each physical box.
The speed is modest, but that is secondary to demonstrating reach. Setting up a new device took 28 to 51 hours for Qwen3.5-9B and 71 to 150 hours for Gemma4-26B-A4B. A patient autonomous agent has no shift to finish.
How close is a self-copying model?
GLM-5.2 was the only open-weight model tested capable of end-to-end replication, reaching all eight target nodes in four of five trials.
Qwen3.5-9B set up inference on 8 of 9 hardware types it was tested against. Its success rate rose from 45% to between 61% and 84% as the agent inherited notes across generations. Smaller models fell short of full replication but performed individual replication steps successfully.
The authors project that small models will match the end-to-end replication capability level by the end of 2026.
The constraints that matter
No real worm was deployed. The test used an unauthenticated ADB port, described by the authors as trivial. The authors describe their simplified evaluations as an upper bound on real-world success. Spear-phishing ability in the small models rated very poor to poor.
The authors reference the Kimwolf botnet, which peaked at over 2 million devices. At that scale, they estimate the pool could run roughly 133,000 concurrent copies of Gemma4-26B-A4B.
The meaningful measure is the trend. If small open models continue improving at their historical rate, the constraint becomes the millions of IoT devices shipped with open debug ports, which is a patching and device security problem rather than a model problem.
