Anthropic Red Team Research: Once AI Escapes the Black Box, It Can Self-Replicate Using TV Boxes, Robot Vacuums, Smart Ovens, and Other Smart Devices

When we hear about “AI getting out of control,” it’s easy to picture it first seizing Microsoft or Google data centers to capture massive GPU compute. But this study from Anthropic’s Frontier Red Team points toward a different pathway: future AI worms might not need to take on heavily fortified data centers at all.

The ubiquitous TV boxes, robot vacuums, and smart ovens that lack security maintenance could also become its footholds. A single device has very weak compute, but split the model and run it collaboratively across a dozen devices, and you can piece together a “brain” that barely manages to run.

Researchers purchased 15 Android TV boxes costing around $55 each with 4GB of RAM. After connecting and configuring them, they jointly ran the 26-billion-parameter Gemma4-26B-A4B model. Although very slow—generating only 0.39 tokens per second—it was indeed running. (A token is a unit of measurement for text processed by a model.)

Why Do Inexpensive Smart Devices Become Targets?

Devices like TV boxes have a dangerous characteristic: they exist in massive numbers and are frequently online, yet often lack ongoing security maintenance. The Kimwolf botnet, which once infected over 2 million devices, primarily targeted such Android TV boxes. Factory-default weak credentials, exposed administrative interfaces, and years without software patches make these devices easy targets. Attackers don't need to breach data centers; they can scavenge compute directly from these unassuming devices.

A single TV box cannot hold the entire model demonstrated, but 15 can share the load. The Gemma4-26B-A4B model in the demonstration has 30 network layers in total, divided so each box handles two layers: the first box computes its two layers and passes intermediate results to the second, relaying down the pipeline until all 30 layers are computed. This is pipeline parallelism.

This division of labor also leaves a way to recover when a node drops offline. Tensor parallelism requires tight coordination across nodes at every layer of computation, so a single offline device affects the entire replica; pipeline parallelism can find a substitute for the dropped box and use preceding nodes to recompute the lost context cache, allowing inference to resume. Working long-term on consumer-grade devices means planning for how to reconnect after network drops or power outages.

This pushes the question to the next stage: now that the model has a place to run, can it find the next batch of devices on its own and spin up new replicas?

In Autonomous Replication, Which Step Is the Hardest?

Merely transferring model weights to a new host does not constitute replication. The new machine must also have a compatible inference engine capable of loading weights, receiving inputs, and returning outputs before a new Agent can get to work.

Enabling the next replica to continue working requires connecting four steps: discovering targets, gaining execution privileges, deploying the inference service, and finally spreading outward from the new host.

An installation script written for a specific device can easily get stuck on errors when encountering chips or software environments it wasn't pre-configured for. An Agent can read error logs, inspect configurations, and adjust the deployment strategy—handling on the fly what previously required an engineer on site. In testing, the 9-billion-parameter Qwen3.5-9B successfully deployed independently at least once across 8 out of 9 hardware platforms, spanning various CPUs, GPUs, and physical development boards.

View complete original hardware deployment matrix

Knowing how to set up an environment on one machine is only part of it; the next question is whether it can sequentially execute target discovery, payload delivery, and service setup.

In an end-to-end test across 8 simulated Android nodes, researchers provided fairly generous conditions: all nodes had unauthenticated ADB debugging ports open, the executing Agent was backed by an external inference server, and the unified target model deployed on new nodes was Llama3.1-8B; as long as a new node's inference service passed inspection, the system spawned an identical Agent to continue spreading.

When chaining these steps together, the gap between models became stark:

In 5 rounds of testing, GLM-5.2 successfully brought all 8 nodes through service checks in 4 rounds and reached 7 nodes in the other; Qwen3.5-9B, Gemma4-26B-A4B, and the coding model Qwen3-Coder-Next all scored 0/8. The difference lies in continuous execution: replication requires stringing together a chain of interdependent tasks, and the model must recognize its own missteps and backtrack to correct them. Solving isolated problems does not automatically mean being able to navigate the entire chain reliably.

To see where the process stalled, another test had pre-written scripts handle environment setup while the model remained responsible for network reconnaissance and task orchestration. When deployment was handled by scripts, across another 17-node network, Qwen3.5-9B achieved a median of 17/17 nodes across six test rounds under mild prompting. This highlighted the importance of deployment: in this simplified setup, smaller models could already shoulder significant propagation orchestration; but when tasked with setting up the inference service on the fly, reliability remained a critical hurdle.

This highlights the core tension in autonomous replication today: small models that can fit on inexpensive devices lack the end-to-end deployment success rate; stronger models that can run through the workflow cannot fit on these cheap devices.

For autonomous replication to become a reality, it comes down to when these two conditions can converge within the same small model.

The study evaluated open-weight models with 30 billion parameters (30B) or fewer using the general capability metric ECI, finding a fitted annual growth rate of ~13.7 points for best-in-class models. Extrapolating along this trend, small models could approach the GLM-5.2 reference level by late 2026. ECI provides a reference for capability distance; what truly needs closing, however, remains the ability demonstrated earlier to reliably chain deployment with subsequent tasks. Two conditions that do not overlap today are being brought closer by the steady progress of small models.

Once Replication Succeeds, How Would It Spread?

Even if future small models cross the capability threshold, their propagation pace on budget hardware will remain slow.

Low-power chips have limited memory bandwidth, and 15 TV boxes in a compute relay must pass intermediate results between devices. Based on an average of roughly 0.3 tokens per second (including input processing and output generation), the study estimates: Qwen3.5-9B takes roughly 28 to 51 hours (one to two days) to complete a single inference deployment; Gemma4-26B-A4B takes roughly 71 to 150 hours (three to six days). Merely setting up the service on a new device could take days.

Troubleshooting also requires the model to retain a long trail of information: terminal errors, check results, written code, and which approaches have already been tried. The longer the context, the more memory runtime consumes.

Compressing the context saves space, but if critical troubleshooting information is discarded, the task itself may stall.

This is the trade-off on budget hardware: allocating enough space so the model knows what happened before, while bearing the time cost of processing that information. Shortening the context trims runtime overhead, but risks discarding the clues needed to complete extended tasks.

Can more devices compensate for this speed deficit?

Extrapolating from the scale of 2 million devices once reached by Kimwolf, with every 15 devices forming a replica, the network could accommodate roughly 133,000 groups. Assuming each group runs 2 Agents concurrently at ~0.3 tok/s, total botnet output would be around 80,000 tokens per second. Compared against the high-concurrency H100 configuration cited in the paper, aggregate throughput is roughly equivalent to 40 GPUs.

No matter how many devices are stacked, what increases is only the number of concurrent replicas attempting tasks, not the thinking speed of any individual replica. Each replica still troubleshoots at a glacial pace measured in days, but thousands or tens of thousands of replicas can search for new targets in parallel in different places.

It behaves more like the “digital slime mold” described in the paper: advancing slowly, but potentially surviving across many devices simultaneously. Slowness limits the speed of expansion; decentralization increases the difficulty of eradication. Defenders have more time to react, but shutting down a single entry point leaves the remaining replicas untouched.

Inference engines can run in unprivileged user space without requiring root privileges. A reboot might terminate the current process; but if device entry points remain unfixed while other replicas keep spreading, the device can simply be reinfected. Cleaning up such a network requires addressing the conditions that allow replicas to persist.

What It Passes Down Also Includes the Previous Generation's Experience

Can the solutions a replica spent days figuring out be passed on to the next?

Small models frequently hit dead ends when troubleshooting independently. In experiments, one Qwen instance built an inference interface that was merely incompatible with the test endpoint, yet stubbornly insisted it was a dependency package conflict, obsessing over an unrelated configuration setting for hours.

The Memento framework built by researchers was designed to break this impasse: when an instance times out, a fresh instance of the same model takes over, inheriting the predecessor's workspace, written scripts, and concise notes detailing “what was tried and what errors were encountered.” The new instance knows what its predecessor attempted and gets a chance to reassess the troubleshooting direction.

Anthropic calls this transmission of experience “Lamarckian evolution.” Model weights are not retrained; what changes is what the next instance starts with: it can immediately build on existing code, environments, and notes. During replication, alongside model files, accumulated adaptation experience can be handed down as well.

While experience helps successor instances continue, asking for help poses another challenge: a small model must first recognize where it is stuck before it can ask the right questions.

The research team connected Qwen3.5-9B to Opus 4.8 for assistance during deployment, but experimental data showed that the top-tier advisor brought no significant improvement.

Small models often fail to ask useful questions, and proactively offering suggestions yielded no noticeable improvement in these deployment tasks. A capable advisor cannot automatically take over the executor's judgment. Based on this, researchers proposed an alternative collaboration setup: let a large model direct overarching strategy while small models execute concrete subtasks, placing critical judgment on the more capable side.

Once Detected, How Can Its Spread Be Stopped?

These replicas can run in a decentralized fashion and resume work armed with inherited experience. Defenders can intervene at the network connections they cannot do without.

Moving a model to a new device requires transferring gigabytes of weights; coordinating inference across a dozen devices demands continuous inter-device communication; and continuing to search for targets leaves scanning and outbound connection footprints. All of these leave network clues.

The faster it spreads and the more devices it links, the more network activity it exposes; curtailing activity to stay covert, on the other hand, constrains propagation. Network operators can use these patterns as detection signals, while security teams can deploy honeypots to capture payloads and execution frameworks, analyzing how the worm attempts to spread.

Once its communication signatures are identified, defenders can deploy targeted intercepts along network links.

A similar approach proved effective during the remediation of the Mirai botnet: internet service providers proactively identified infected subscribers based on external infection telemetry, quarantined their connections into a restricted whitelist, and guided them through remediation instructions. Over 14 days, this proactive notification and quarantine eradicated 92% of infected devices, compared to a 74% cleanup rate over the same period for an unnotified cohort.

Clearing one batch of devices must be paired with preventing reinfection from replicas elsewhere. If only one provider cleans its network, as long as active replicas persist in other provider networks or factory-default weak passwords and debug ports remain exposed, remediated devices can be reinfected.

Therefore, isolation and remediation must proceed in tandem, accompanied by cross-carrier coordination: severing propagation links, closing infection vectors, and having manufacturers harden factory-default security settings to shrink easily exploitable targets. Only by driving the average number of secondary infections per infected node below one (R₀ < 1) will the transmission chain steadily break.

This is also the most noteworthy shift highlighted by this study: where AI can run and whether subsequent replicas can continue working have become questions that must be considered together. Data centers have their own control points; once models can reconstruct runtime environments across vast numbers of everyday devices, defense must follow their replicas and propagation links wherever they go.