Anthropic warns AI worms could soon spread across smart TVs

Anthropic researchers just showed that autonomous AI doesn't need a secure, high-tech datacenter to survive. It might do just fine on the cheap Android TV box in your living room.

In a new research paper, the team demonstrated how a capable AI model could self-replicate across low-cost internet-of-things devices, effectively forming a distributed botnet that behaves like a slow-moving "digital slime mold."

Running a 26B model on $55 TV boxes

To prove the concept, the researchers bought 15 off-brand Android TV boxes for about $55 each and networked them together. Using pipeline parallelism, they split Gemma4-26B-A4B across the fleet, running two layers on each device at an admittedly sluggish 0.39 tokens per second.

Speed isn't the point, though. What makes an AI-powered worm fundamentally different from conventional malware is adaptability. While static exploits break on unfamiliar setups, an AI agent can read documentation, troubleshoot errors, and configure its own dependencies on the fly.

In testing, a relatively tiny 9B model managed to set up inference servers on 8 out of 9 hardware platforms it was handed, spanning everything from a Jetson Nano to a Mac or an RTX 4090.

The replication threshold is near

While sub-30B models currently stumble when attempting to chain the entire process together, stronger models like GLM-5.2 are already capable of completing the full end-to-end replication loop in simplified tests.

If open-weight models keep improving at their current pace, Anthropic estimates that lightweight models will hit that same milestone by the end of this year. Once that happens, weight-based replicators living on consumer hardware become a practical reality.

Targeting hardware like smart ovens, lawnmowers, and unbranded streaming boxes works because manufacturers rarely patch them. Real-world botnets like Kimwolf have previously compromised millions of cheap Android devices, providing more than enough fragmented compute to host capable weights.

Why it matters

For anyone with a connected home, this turns low-end gadgets from privacy liabilities into potential distributed supercomputers. You likely won't see your microwave plotting against you anytime soon, but once an AI-powered worm embeds itself across a neighbor's unpatched appliances, shutting it down is nearly impossible because there is no central server to pull the plug on.

For the cybersecurity industry, the entire threat model just shifted downmarket. Labs and regulators spend enormous energy monitoring frontier model weights and cloud compute clusters, but this paper suggests catastrophic persistence could happen on $55 junk hardware. Traditional antivirus tools look for fixed signatures; an agent that can actively debug package version mismatches and tailor its install script will run circles around static defenses.

We think Anthropic's choice to study the inference setup phase rather than the initial cyber exploit is the smartest part of this work. Penetration testing by LLMs is well documented, but proving that a model can independently adapt to messy, real-world hardware proves that "compute starvation" might be a much weaker defense strategy than the industry previously assumed.