The worm that thinks. It could live in a $55 TV box.

Picture fifteen small black boxes on a lab bench. They are off-brand Android TV streamers, the kind sold online for about $55 each, with a few gigabytes of memory and no fan. Wired together, they are doing something none of them could manage alone. Each box holds two of the thirty layers of Google's Gemma4-26B-A4B model. A token goes in at box one, passes through every box in turn and comes out at box fifteen as one word of an AI's answer.

The model runs at 0.39 tokens a second, which is slower than you read this sentence. As a chatbot it would be useless. Anthropic's researchers are making a different point: software that never has to talk to a person doesn't care how slow it is.

The demo opens a study published on 12 October by William Zhou and Daniel Freeman of Anthropic's Frontier Red Team. Its headline claim is careful but unsettling. Small AI models "may be months away" from being able to self-replicate on everyday internet-connected devices, from smart ovens to cheap TV boxes. A replicator like that would be hard to shut down, because there would be no central switch to turn off.

What Anthropic actually tested

Security people have worried about autonomous replication for years: an AI system that copies and runs itself with no human in the loop. A classic computer worm copies its code from machine to machine. An AI worm would also carry its own brain, the model weights, and run them on whatever hardware it lands on.

The researchers split that loop into four stages and focused on the least-studied one.

Stage three is harder than it sounds. Getting an AI model to run on unfamiliar hardware means choosing software that suits the chip, finding package versions that work together and fixing whatever breaks. Every step depends on the one before, and one mistake can sink the whole attempt. It is fiddly work that has long been treated as a human job.

Small models turned out to be good at it. A 9-billion-parameter model, Qwen3.5-9B, got a model serving on eight of the nine kinds of hardware it was given, ranging from cloud servers to a Mac to hobbyist boards.

Can it do the whole loop?

Doing one step is not the same as chaining them together. To test the full cycle, the team built a firewalled network of eight emulated Android machines in the cloud. They planted the worm on one machine, "patient zero", and watched whether it could spread to the rest and get a model running on each one, with no human help.

The answer split the field cleanly. Most models failed every time. One succeeded almost every time.

The floor and the ceiling

That gives the study its central framing. A self-copying model needs to clear two bars at once:

• A capability floor. It has to be smart enough to finish the loop reliably. In the simplified test, GLM-5.2 is above that floor.
• A size ceiling. It has to be small enough to run on the devices it lands on. For 4GB TV boxes, models of about 30B parameters or fewer qualify.

Right now no model is both. The question is when the small models catch up, and Anthropic answered it with a trend line.

So "months away" is a forecast built on a stand-in. It assumes small models keep improving at their historical rate, and that general ability on Epoch's index tracks the narrower skill of finishing the loop. Anthropic flags both as rough. It also says it has not built a working rogue replicator. Models that manage each step on its own still make mistakes when they have to chain them.

Speed is the other brake. At a fraction of a word a second, setting up on each new device would take a day or more. That makes any such worm slow, but Anthropic's point is that slow is not the same as harmless, because a program with no deadline can afford to wait. Roman Yampolskiy, an AI and cybersecurity researcher at the University of Louisville, told Al Jazeera the findings were significant. In his view the threat is not existential today, but the trend is worrying.

Why the cheap box is the soft spot

A data centre would be the obvious prize for an AI worm, and Anthropic says so. It is also the best-defended place on the internet. Home and small-business gadgets are the opposite. They are always on and always online, and as a class they have a long record of weak security: default passwords, debugging features left switched on, and firmware that stops getting updates soon after the box is sold. Anthropic notes that off-brand devices built on forks of Android often lack the security features the big manufacturers add.

None of that is new. In 2016 the Mirai botnet took over hundreds of thousands of cameras and routers, mostly by logging in with factory passwords, and used them to knock major websites offline. An AI worm would add something Mirai never had, the ability to work out what to do on a device it has never seen. And with no central server to seize, there would be no single plug to pull.

How to keep it from happening

The useful news in the study is that the defences are mostly ones security people already know. Anthropic's argument is that they now matter more, because they work against old-style scripted botnets and AI ones alike.

Device makers have the biggest lever. Secure defaults shrink the pool of easy targets for every kind of attacker. Since April 2024 the UK's product security regime has banned universal default passwords on connected consumer products and made manufacturers say how long they will ship security updates. The EU's Cyber Resilience Act goes further, requiring secure-by-default settings and security updates for connected products from December 2027. Anthropic's ask is simply to raise that baseline and enforce it.

Networks and ISPs are well placed to spot one. A replicating model would not be quiet. It would pull multi-gigabyte model files onto gadgets that normally just stream video, keep devices talking to each other for hours, and probe the network for its next host. All of that stands out in the flow monitoring ISPs already run. Decoy devices, or honeypots, could then capture a copy for analysis. The worm also faces a built-in trade-off: the faster it spreads, the more traffic it makes and the easier it is to see.

Once infected devices are found, there is good evidence that cleaning them up works. Anthropic points to a study of the Mirai clean-up at one ISP, where quarantining infected customers and telling them how to fix their devices cleared noticeably more infections than leaving them alone.

Owners can do most of the rest in an afternoon. None of this is specific to AI. It is the same advice that would have blunted Mirai:

• Change any default password, and skip gadgets that won't let you.
• On Android TV boxes and streaming sticks, leave developer options and network debugging switched off unless you are using them right now.
• Prefer brands that publish how long they will provide updates, install those updates, and retire boxes that no longer get them.
• Put smart-home gadgets on a guest or separate network, so a compromised one can't reach your laptop or phone.
• Turn off UPnP and port forwarding on your router if you don't need them, so devices aren't reachable from the open internet.
• Unplug what you don't use. A box that is switched off can't be anyone's computer.

AI labs get less specific advice. The post flags related risks closer to home, such as unmonitored internal deployments and stolen model weights, but doesn't set out fixes for them. Its wider conclusion is to harden systems now, and to plan for the possibility that replicators like this, once they exist, never fully go away.

What to watch next

Three things will show whether the forecast holds. The first is the next round of small open models. If one lands near GLM-5.2's score on Epoch's index, the floor has been reached on paper, and the open question becomes whether such a model can actually finish the loop. The second is whether other labs and independent testers repeat these experiments, since one team's lab setup is a narrow base for a forecast. The third is the slow, unglamorous work on device security, from UK-style rules spreading to other markets to ISPs treating strange gadget traffic as a warning sign.

The honest summary is that nothing in this study is loose on the internet. What it shows is that the gap between models that are capable enough and models that are small enough is closing, and that the cheapest computers in our homes are the least ready for it. The fixes are boring and well understood. That is the good news.