Anthropic's Frontier Red Team published a study on October 12 arguing that small AI models may soon be able to copy themselves across cheap connected devices, per Anthropic. The authors, William Zhou and Daniel Freeman, bought 15 off-brand Android TV boxes at about $55 each. They ran Google's Gemma4-26B-A4B across all of them. It worked, at 0.39 tokens per second.
A 9B model got inference running on 8 of the 9 hardware types the team tested, with no human help. A separate test asked models to spread across eight emulated Android devices in a sealed cloud network, each with an open debugging port. Only GLM-5.2, an open-weight model from Zhipu AI, did it reliably. It reached all eight nodes in four of five trials and seven in the fifth.
The authors flag the limits. The exploit step was kept "trivial," since the debugging port asked for no password, so they call the result "an upper bound on real-world success." No model tested was both capable and small enough to replicate reliably on a smart TV, per Al Jazeera. The timeline comes from a trend line. If small models keep improving at their historical rate, they match GLM-5.2's level "by the end of this year." The authors call that a rough estimate.
The threat model is a botnet that already exists. Kimwolf infected "over two million devices," mostly Android TV boxes. An AI replicator would differ by working out unfamiliar hardware on its own. Anthropic's proposed defenses are old ones. Internet providers can quarantine infected customers, which cleared 92% of Mirai infections within 14 days in one study, against 74% without notice. Device makers can drop default passwords and open ports.
Bottom Line
The study measures one step, standing up a model on hardware the attacker does not own, and that step nearly works today. If you run an office or a store, find the cheap Android boxes and smart screens on your network and close any open debugging port. If you make connected devices, ship them without default credentials. The UK already requires it.