The $55 box that made the threat feel real #
Anthropic’s recent research posed a direct, unsettling question: could an AI agent autonomously propagate across a network? Their controlled experiment, not a real-world appliance compromise, demonstrated key ingredients of such a threat. The findings suggest that future models could achieve this capability sooner than many expect.
To explore this, researchers acquired 15 off-brand Android TV boxes, each costing roughly $55 and equipped with 4 GB of RAM. These inexpensive, consumer-grade devices were then networked, simulating a potential distributed compute environment. The goal was to see if such low-cost hardware could contribute to a collective, decentralized inference system.
Crucially, this setup tested components of a possible AI worm, not a fully realized, self-replicating model already embedded in smart TVs, refrigerators, or ovens. It examined the theoretical capacity for an AI agent to spread and establish distributed inference on commodity hardware. The experiment aimed to understand the potential for future AI agents to use such networks for their own operations, rather than demonstrating an immediate threat from current smart devices.
How Gemma got split across the network #
To run an AI model on such constrained hardware, Anthropic employed layer sharding. They divided Google’s Gemma4-26B-A4B, a 26-billion-parameter open model, across the 15 networked Android TV boxes. Each box received approximately two sequential layers of the model, passing its computational output to the next device in the pipeline.
Distributing the model in this manner made the experiment feasible, allowing the entire Gemma model to execute across the low-cost hardware. However, this serial processing came at a significant performance cost: the pipeline produced only 0.39 tokens per second. This translates to roughly a minute for a short sentence, underscoring the severe latency inherent in this distributed setup.
This experimental configuration, while demonstrating distributed inference, does not equate to a practical botnet threat. The slow, network-dependent inference contrasts sharply with the rapid execution required for widespread compromise. Furthermore, the relatively capable TV boxes, each with 4 GB of RAM, differ significantly from the tiny, resource-constrained microcontrollers found in many real-world IoT appliances. Anthropic’s setup proved a concept, but not a readily deployable weapon.
One model spread; the crucial pieces didn’t overlap #
Researchers tasked an AI agent with propagating across a simplified eight-machine network. This agent, essentially a small program capable of executing commands, used a large language model as its reasoning engine to discover targets, gain execution, and establish inference on new nodes.
Of the models tested, only GLM-5.2 successfully executed the full propagation task. Running on a separate, powerful host machine, GLM-5.2 reached all eight target machines in four of five experimental runs, and seven of eight in the remaining run. Other models consistently failed to complete the multi-step process.
This demonstration, while compelling, highlights a crucial distinction: capability versus deployability. GLM-5.2, a 753-billion-parameter model, is far too large to run on a $55 Android TV box. For further reading on this research, Anthropic’s full findings are available: AI models may be capable of self-replicating without access to a datacenter.
The smaller Gemma model, distributed across the TV boxes, was shown to operate in a sharded configuration but was not tested for full autonomous propagation. Therefore, the model intelligent enough to autonomously spread was too large for edge devices, and the model small enough for edge devices was not shown to can self replicate now. The convergence of these two critical factors remains a future concern, not a present reality.
Enjoying this? Get one like it in your inbox each morning.
one email a day · unsubscribe in two clicks · no third-party tracking
The risk is a forecast, not a countdown #
Anthropic’s late-2026 estimate serves as a forecast, not a deadline. The core concern projects that future small models (~8B parameters) could combine the edge-device usability of Gemma4-26B-A4B with the autonomous cyber capabilities demonstrated by GLM-5.2. This suggests a potential convergence where a model can both run on a $55 Android TV box and independently propagate.
However, real-world networks present significant obstacles that this simplified benchmark did not fully capture. Varied hardware, complex authentication protocols, robust firewalls, and unreliable connections would introduce compounding errors for an autonomous agent. The current 0.39 tokens per second inference rate also highlights the extreme latency of such a distributed system.
The tests involved publicly available model weights, sparking debate about the framing of Anthropic’s research. Some critics suggest the focus on open-weight models could fuel calls for their restriction. Distinguishing these policy concerns from the experiment’s measured technical results is crucial.
Regardless of the debate, the practical priorities remain clear: strengthening network defenses, implementing robust access controls, and enhancing monitoring for unusual AI agent activity. The experiment underscores the evolving threat landscape, emphasizing the need for proactive security measures against future, more capable AI systems.
Frequently Asked Questions #
Did Anthropic demonstrate an AI worm spreading across real smart appliances?
No. The experiment used a simplified test network, not a real-world attack on household appliances.
Could the tested AI model run on an Android TV box?
The distributed Gemma setup ran across multiple boxes, but the model that completed the propagation tasks ran on a separate, much larger host.
Why does AI self-replication matter?
An adaptive agent that can find devices, execute tasks, and deploy itself could make some cyber threats harder to predict and contain.
Is an AI-powered IoT botnet imminent?
The test does not show that one is imminent. It highlights a possible future risk while exposing major capability and hardware constraints today.