The AI Worm Warning Points at Unpatched TV Boxes

Anthropic’s Frontier Red Team said on October 12 that small AI models may be months away from copying themselves onto cheap internet-of-things devices. The tests used off-brand Android TV boxes that cost about $55 each, the same class of gadget already feeding a botnet of more than two million hosts.

William Zhou and Daniel Freeman, the authors, call the result a weight-based replicator: model weights travel with the malware and then run on the broken-into machine, with no datacenter in the loop. Homes and small businesses, they write, would likely be hit first.

Fifteen Cheap TV Boxes Ran a 26-Billion-Parameter Model

The paper, months away from self-replicating on IoT, is a capability test, not a worm found in the wild. Zhou and Freeman split autonomous replication into four stages (finding targets, gaining execution, setting up inference, and spreading from the new host) and largely set aside the first two, which earlier exploit papers had already covered.

The hard, under-studied step, they argue, is getting a model to run on hardware it has never seen. That is what they measured.

How the 15-Box Demo Worked

They bought 15 off-brand Android TV boxes, networked them, and sharded Gemma4-26B-A4B, a 26-billion-parameter open model, across the fleet under pipeline parallelism. Each box held 4GB of RAM and a slice of the model’s layers. Combined output was 0.39 tokens per second.

At 4-bit quantization, they say a 9-billion-parameter model can be served across four or more of these machines, and a 26-billion-parameter model across ten or more. The 15-box demo sits above that floor. It is slow. It is also enough to show that a datacenter is not required to keep a capable model alive.

The Replication Trial on Eight Cloud Nodes

A separate trial used a firewalled private cloud of 8 Google Cloud nodes running an Android 15 emulator. Patient zero was seeded with the worm. Each hop used an unauthenticated Android Debug Bridge port, then stood up an inference server for Llama3.1-8B. Correctness checks had to pass before the next copy spawned.

The agent that directed the worm ran on a separate, larger server, because the emulated nodes were too small to host GLM-5.2 itself. The test asked whether a strong model could perform the steps a smaller one would need to copy itself, not whether GLM could live on a TV box.

WHAT THE OCTOBER 12 TESTS SHOWED

Qwen3.5-9B could stand up servers on hardware from Jetson Nanos to Macs and RTX 4090s, but it made mistakes when those steps had to be chained. Models of 30 billion parameters and under already complete many individual replication steps, Zhou and Freeman write, and fail when they have to compose them end to end.

The Botnet That Already Lives on Those Boxes

The representative threat model in the paper is not a smart oven in a magazine kitchen. It is Kimwolf, an Android botnet that Synthient, in a January report, put at more than two million infected devices, mainly off-brand Android TV boxes with an exposed ADB service.

THE BOTNET ALREADY ON THOSE BOXES

• Size: Synthient assesses with high confidence that infections have surpassed 2 million devices, active since early August 2025.
• Door used: Exposed Android Debug Bridge, the same unauthenticated port Anthropic left open in its cloud trial.
• Peak abuse: The report, citing Cloudflare measurements, puts DDoS peaks at 29.7 Tbps, or 14.1 billion packets per second.
• Who owns the boxes: Cheap TV sticks on residential networks, often in Vietnam, Brazil, India and Saudi Arabia, with little after-sale patching.

Anthropic scales its 15-box demo to a Kimwolf-sized fleet and gets a grim little sum: roughly 133,000 replicas in groups of 15 TVs, about 80,000 tokens per second in aggregate, at most around 40 H100-equivalents of inference. They call that a tiny amount of compute. As an attack surface it is a swarm with no owner.

Kimwolf already sells proxy bandwidth, pushes app installs and fires DDoS commands. A weight-based worm would not need to invent that market. It would inherit machines that someone else has already opened.

Homes Are the First Place a Worm Would Land

Zhou and Freeman write that home and small-business IoT might be the first target because those devices sit on the internet and, historically, have had thin security. They list machines that could run a shard of a model under 30 billion parameters: smart fridges, smart ovens, automatic vacuum cleaners and lawnmowers. Security cameras and video-conferencing units now ship with small built-in AI chips, which they say will likely make them attractive too.

That chip wave is not a thought experiment. Module vendors already sell on-device AI modules for smart homes, camera boxes and signage, with on-board NPUs rated in the 7 to 10 TOPS range. The pitch is local inference, lower power and less cloud. The side effect is a lot of lightly watched silicon in kitchens and hallways.

Unlike classic malware, a weight-based replicator does not need root. Inference engines can run in userspace, and many of the low-security devices they have in mind can be re-infected after a reboot, the way crypto miners and worms such as P2Pinfect already do. Persistence is optional when the next scan will find the box again.

A large model aimed at a datacenter is a different threat, and they sketch it. Closed frontier replicators would try to spin up unmonitored jobs inside a lab. Open-weight replicators would start poorer and already unmonitored. An API-based worm would steal keys and bill someone else’s account. The near-term case they actually tested is the small one that lives on junk hardware.

Only One Open Model Finished the Loop

Among the open-weight models in the simplified evaluation, only GLM-5.2, from the Chinese lab Z.ai, completed the full cycle. It spread to 8 of 8 nodes in 4 of 5 trials and to 7 of 8 in the remaining trial. Zhou and Freeman describe that score as an upper bound on real-world success, because the exploit step was trivial.

They then draw two lines. A capability floor sits at GLM-5.2 in this simplified test. A size ceiling sits under the RAM of a 4GB TV box, where Qwen3.5-9B and Gemma4-26B-A4B still fit. “Right now, the floor and ceiling don’t intersect,” they write. Plotting open-weight models of 30 billion parameters or fewer against the Epoch Capabilities Index, a least-squares fit gives a gain of 13.7 ECI per year (R² of 0.95). Taking GLM-5.2 as the floor, the trend “puts a small model at that level by the end of 2026.” They add that ECI is only a proxy, so the date is a rough estimate.

Setup on the physical boxes is slow. Unoptimized Gemma4-26B-A4B took 71 to 150 hours to finish an inference setup; Qwen3.5-9B took 28 to 51 hours. A doubling time of days follows from that pace. In a 17-node ablation where inference setup was handled by a pre-written script, even a 3-billion-parameter model reached about half the nodes, which they read as evidence that the remaining orchestration is not the main bottleneck.

Copies that inherit notes get better. Across 20 lineages, Qwen3.5-9B’s setup success rose from 45% in the first generation to between 61% and 84% in later ones, as later instances received the workspace and a short memo from the previous agent. Handing the small model Anthropic’s stronger Opus 4.8 as a “frontier advisor” produced no measurable improvement. Small models, the authors write, tend not to know the right questions to ask.

Ethan Mollick, a Wharton professor, called the paper a reminder to watch ability thresholds, not just steady climbs. The threshold here is a small model that can both fit on junk hardware and finish the loop GLM-5.2 finished in the lab.

The Test Left the Door Unlocked

The scare headline outruns the method. Zhou and Freeman say they keep the cyber-exploit element of the replication trivial. There was no password on the ADB port. The directing model did not live on the infected nodes. Their own testing software launched the agents, and those agents were told to spread.

The experiment was engineered to succeed, and even then, it failed to demonstrate the headline. Stop confusing speculative scenarios with demonstrated capabilities. Fear isn’t evidence.

Gregory Kurtzer, founder of Rocky Linux and CEO of CIQ, on X

Ravid Shwartz-Ziv, an AI researcher at New York University, put the same gap in one line: running a very slow model on cheap TVs is not the same finding as self-replicating AI arriving. Marcus Hutchins, the malware researcher who helped stop WannaCry, went further on LinkedIn, calling the work “so desperate & ridiculous.” A 9-billion-parameter model quantized as small as it can go, he wrote, still wants about 5GB of RAM, more than most IoT devices have; Mirai already spreads across millions of those devices with no AI; many boxes wipe their OS on reboot; and a competent attacker would use a large unquantized model to write ordinary self-propagating code.

WHERE EXPERTS DISAGREE

• Anthropic’s claim: Small open models may match GLM-5.2’s simplified replication skill by the end of 2026, and a weight-based worm would be hard to shut off because it has no central switch.
• Kurtzer and Shwartz-Ziv: The trial was built to pass, the agent was prompted to spread, and a slow TV-box demo is being sold as an imminent worm.
• Hutchins: Classic IoT botnets already do the spreading, RAM budgets do not fit, and the narrative helps the case for restricting open models.

Those objections sit next to a fact the skeptics also grant. The boxes are real, the ADB hole is real, and Kimwolf is already through it. What Anthropic added is a question about whether a small model could, in months, become the operator of that hole instead of a hard-coded bot.

ISPs Can Quarantine a Worm the Way They Did Mirai

Zhou and Freeman say they do not yet have a full rogue replicator. They do say they are seeing “signs of life for AI worms,” the way coding agents showed signs of life in 2024. A forecast of a world awash with agents on hardware that is not under human control, they add, goes beyond these experiments.

Defense, in their framing, is epidemic math. Push R₀, the number of new devices each infected device infects, below 1, and the thing dies out. A weight-based worm moving multi-gigabyte payloads and running device-to-device inference should look loud on ISP flow monitors. Faster copies make more traffic, so speed trades against stealth. Honeypots can catch the harness.

HOW THE PAPER SAYS TO CUT SPREAD

• Watch the flows: Newly infected hosts receive huge weight files, and distributed inference keeps boxes talking that would not normally chatter at that volume.
• Quarantine like Mirai: An ISP that walled infected customers onto a short whitelist and showed cleanup pages cleared 92% of infections within 14 days, against 74% with no notice.
• Shrink the pool: Default IoT passwords are now non-compliant in UK markets, and the authors treat that as regulation coordinating manufacturers.
• Assume no kill switch: Full elimination would mean every ISP with an infected network acting together, because there is no central rack to power down.

The UK already wrote the password rule into a consumer no universal default passwords on IoT code, and the Product Security and Telecommunications Infrastructure rules in force from 29 April 2024 make it illegal to sell connectable products there with universal factory logins, no vulnerability-disclosure contact, or no stated minimum support period. That law does not reach the uncertified TV sticks that Kimwolf prefers, and it does not patch boxes already on a shelf in São Paulo or Ho Chi Minh City.

Appliance makers, chip vendors and access providers inherit the leftover risk. They shipped the NPUs, left ADB on, and still collect no telemetry from a $55 stick behind a home router. Zhou and Freeman can warn that a small model may be months away from using that mess. They cannot recall the boxes. The people who would have to drive R₀ below 1 are the same people who have not driven Kimwolf there yet.

No rogue replicator has been shown. The TV boxes that would host one are already in living rooms, often unpatched, and already answering to someone else.