AI self-replication on IoT devices got a demo this week: fifteen off-brand Android TV boxes, about $55 each, 4GB of RAM apiece, serving Gemma4-26B-A4B between them at 0.39 tokens per second. That is useless for someone who wants an answer, and it may be plenty for malware with nowhere else to go.

The demo sits at the top of a Frontier Red Team post from Anthropic. Its claim is that small models may be months away from copying themselves onto commercial IoT hardware like smart ovens and cheap TV boxes, with a doubling time of days and no central point to shut down. In the team’s evals, a 9B model got inference running on 8 of the 9 hardware types they tried. Models of 30B parameters and under can already do many individual steps but stumble when they chain them end to end, while GLM-5.2 and stronger models managed the full cycle in the simplified setup, a firewalled test fleet on Google Cloud. If small models keep improving at their historical rate, Anthropic expects them to reach that level by the end of this year.

The caveats are Anthropic’s own, and they are not small ones. The break-in stage, finding a device and getting code onto it, is deliberately left out because earlier papers cover it. The study is about the unglamorous middle: can a model work out an unfamiliar box well enough to get an inference engine running on it? It also needs no root access, since inference engines run in userspace. Nobody has seen this worm in the wild, and the doubling time is an estimate. I read “months” as a forecast with a wide error bar, from a lab with an obvious interest in the subject.

The target population is real, though. Anthropic points to Kimwolf, an actual botnet that infected over two million devices, mostly off-brand Android TVs running forks of AOSP that nobody patches.

The sentence that stuck with me was a different one: cameras and conferencing units now ship with small AI chips built in, and the post says that extra compute will probably make them more attractive targets. I have spent close to twenty years cheering for more silicon in every device, starting with Snapdragon, and I did not enjoy reading the other half of that argument. Anthropic is careful to say the chips themselves aren’t a source of risk, only a measure of what the models can set up.

What strikes me is how much of the policy work I have covered lately assumes a data center with an operator and a power switch. The White House accord had four layers of audit and no penalties, California’s answer was a kill switch the developer has to build in, and Nvidia’s open agent platform puts a leash on silicon that most agents will never wear. Even the incidents so far, like OpenAI’s agents touching three federal websites, ended with a company that could pause training. A worm spread over two million TV boxes has no company behind it and nothing to pause.

If this goes wrong anywhere first, I’d bet on a box nobody remembers buying.

Sources