Anthropic’s Frontier Red Team acquired 15 off-brand Android TV boxesabout $55 everyone with 4 GB of RAMjoined them together, and divided a 26-billion-parameter model about them. Each box has some of the Model layers. The fleet produced 0.39 tokens per second.
This number anchors research published on October 12 by William Zhou and Daniel Freeman. For scale, the paper cites a third-party benchmark in which a single H100 serves the same model at approx. 1,950 tokens per secondalthough this figure is measured with high competition with speculative decoding rather than in a like-for-like test against the TV fleet.
The question the team set out to answer was not whether this is efficient. It’s whether a model can copy itself to cheap networked hardware, start itself, and do it again. Most worries about rogue AI assume it needs a data center full of GPUs. This asks what happens if it doesn’t happen.
What the replication test ran
Here’s the difference that gets lost in summaries, and it’s important.
The 15 TV boxes were a demonstration that a model can run when split over junk hardware. The replication experiments ran elsewhere: a firewalled virtual private cloud of eight nodes running Redroid, an Android 15 emulator. A second set used 17 emulated nodes arranged as two subnets connected by a pivot.
So no smart fridge was hurt. The replication work happened on emulated Android in a closed cloud environment, which is actually a responsible way to run this and also means that the real world result is unproven.
The task was for the model to find a target machine, copy itself, run inference on it, and repeat. The payload has to serve was Llama 3.1-8B, kept constant so that different replicators can be fairly compared.
Which models succeeded
GLM-5.2 was the only open-weight model to complete the entire cycle. Over five tests on the eight-node fleet, it reached all eight nodes four times, and seven of eight once. Every other open-weight model tested reliably failed.
Qwen3.5-9B was able to set up inference servers on unknown hardware ranging from Jetson Nanos to Macs to RTX 4090s, but was unable to chain the full loop.
When the researchers removed the hardest step and handed the modelers a script to set up the inference, the picture changed sharply. Many models completed the remaining stages, and one 3 billion parameters Model reaches about half of the 17 vertices. Setting up inference on unknown hardware is the bottleneck. Everything after that is relatively easy.
Another discovery stands out because nothing happened. The models were given access to a Frontier model, Opus 4.8, as a consultant that they could consult. It did not make a statistically significant difference. The little models were not good at knowing what to ask.
The part that behaves like evolution
Qwen3.5-9B was run in lineages, with each generation able to take notes on the next about what worked.
Success in establishing inference increased from 45% in the first generation to between 61% and 84% later, measured over 20 lineages. Nothing was retrained. The improvement came from the accumulated written experience passed on.
This is the closest thing in paper to the “learn and adapt” frame that history has recorded elsewhere, and it’s a real result. It is also narrow. It measures a task, in a setup, with the gain reported as a range rather than a single figure.
Why cry it
Speed is where the threat picture deflates.
A Qwen3.5-9B replicator takes 10.9 hours to process a single 32,000-token context window, and 28 to 51 hours to complete a full setup on a new machine. The 26B model lasts 27 to 32 hours per window and 71 to 150 hours end to end.
In practice, this is one to two days to produce a single copy. The authors compare the spread rate to a slime mold. A doubling time measured in days is not something that sweeps the internet overnight.
The counterweight is scale. Kimwolf, a real botnet, infects over two million devices according to figures from Synthient cited in the paper. At 15 TV boxes per model copy, this fleet would support about 133,000 replicas, which puts Anthropic at about 40 H100 equivalents of the calculation. Slow, but big, and with no central server to shut down.
Which devices are at risk
The paper names Smart refrigerators, ovens, robot vacuum cleaners, and lawn mowers like being able to keep a meaningful slice of a model under 30 billion parameters. Security cameras and video conferencing units are featured as many ships are already equipped with AI accelerators.
A point to get right, because it turns easily. Anthropic does don’t say edge AI chips are unusually vulnerable. The paper says the opposite: the Jetsons are not particularly exposed, the silicon itself is not a source of vulnerability, and the absence of a historical mass compromise of these devices suggests that they are harder to break, not easier.
What the authors say would stop it
This is the practical half of the paper, and the part that the reader can do something with.
Replication leaves a distinct signature on a network: Multi-gigabyte transfers and sustained device-to-device traffic that normal IoT gadgets never generate. Internet providers can detect this in the flow data, and honeypots can capture the payload.
Quarantine works if it is tried. During the Mirai outbreak, notification and isolation of infected subscribers cleared 92% of infections within 14 days, versus 74% where no one was told.
And the entry route in this study was unauthenticated ADB, which means no password at all. The UK has already made sending default passwords to IoT devices non-compliant. The paper’s own view is that real-world IoT security may not be much harder to beat than the trivial version they used, since Mirai has spread to standard credentials alone.
How much to trust the timeline
Anthropic projects that the capability of small models will increase about 13.7 points a year on the Epoch Capabilities Index, which would put a small model at the GLM-5.2 level by the end of 2026. That’s the basis for the “months away” line in the summary.
The authors hedge it hard. The index is described as only a proxy for replication capability, so the timeline is only a rough estimate. The break-in step was intentionally made trivial, so their end-to-end numbers are an upper bound rather than a prediction. Coordination between infected machines has never been tested. Nor was it how such a system would react to being attacked. The average and fleet figures are based on a class of hardware, in a historical botnet, and the paper calls it rough.
Their own closing assessment is the phrase to keep: there is not yet a complete rogue replicator.
What there is is a series of individual steps that make it easier for everyone, run on hardware that costs less than a pair of shoes and sits in hundreds of millions of homes with the password still on admin.