An Android TV box is supposed to stream your favorite shows, not run an AI model. But Anthropic managed to run one across 15 inexpensive boxes, and now it warns that everyday gadgets, including smart ovens, could eventually help AI copy itself from device to device.
In research published Oct. 12, Anthropic focused on whether AI agents could run models on unfamiliar hardware and coordinate replication in a controlled network with simplified access. Its experiments showed progress, but none demonstrated a rogue AI worm spreading through real-world networks. For businesses with security cameras, conference-room displays and other connected equipment, the warning raises questions about devices that rarely receive the same scrutiny as computers and servers.
Anthropic tests AI replication on inexpensive hardware
The proposed replication process involves finding targets, gaining access, running a model, and repeating the process.
In Anthropic's research, Google's Gemma4-26B-A4B model ran across 15 Android TV boxes costing about $55 each. It generated just 0.39 tokens per second and did not demonstrate autonomous infection.
Anthropic also identified smart ovens as potential targets. For businesses, security cameras, smart TVs, and conference-room equipment are other connected devices worth reviewing, although researchers did not test them for autonomous AI replication.
In a separate trial, GLM-5.2 deployed Llama3.1-8B across all eight virtual Android targets in four of five runs. The devices exposed unauthenticated debugging ports, while GLM-5.2’s own inference ran externally.
Anthropic estimates that small models could match GLM-5.2’s capability level by the end of 2026, with practical replicators potentially following. This extrapolation uses general capability trends, not a direct replication benchmark.
What eWeek found: Running AI is easier than replicating it
Anthropic acknowledged, "We don't yet have a full rogue replicator." A comparison of its tests reveals a gap: smaller models can run on inexpensive devices, but have not demonstrated reliable completion of the full replication cycle. Even the successful replication test depended on easier-than-real-world access and off-device inference.
Experiment | Demonstrated result | Key limitation |
|---|---|---|
| 15 Android TV boxes | 26B model ran across low-cost devices | No device-to-device infection tested |
| Virtual Android testbed | GLM-5.2 reached eight targets in four of five trials | Unauthenticated access; agent ran externally |
| Qwen3.5-9B adaptation | Inference setup rose from 45% to 61%–84% | No complete replication demonstrated |
In the Qwen3.5-9B experiment, researchers created successive agent instances that inherited notes from earlier attempts and improved inference setup. These instances were restarted by the researchers rather than reproducing autonomously. But better configuration alone did not establish a self-sustaining AI worm. According to Quartz, Anthropic's estimate is that an IoT-based replicator could take days to double, rather than spread rapidly.
Even a slow-moving replicator could leave detectable network activity. Researchers identified possible warning signs, including multi-gigabyte model transfers, unusual device-to-device communication, and repeated network scanning. These behaviors give defenders something concrete to look for, even though no uncontrolled AI worm was demonstrated.
What enterprises should check now
A decentralized replicator could be difficult to shut down because it lacks a single point of control, a concern CNBC highlighted in its coverage. Organizations can take three practical steps:
- Inventory connected hardware. Identify security cameras, conference-room systems, and unsupported IoT devices, especially those with exposed management interfaces.
- Restrict movement. Segment IoT networks, close unnecessary debugging ports, and limit device-to-device access.
- Watch network behavior. Investigate scanning, unexpected model downloads, and sustained connections between devices that rarely communicate.
Anthropic has not demonstrated an AI worm spreading through real-world networks. But its research puts a spotlight on a security gap businesses can address today: connected devices that can download large files or communicate with other systems without anyone noticing.
Whether self-replicating AI arrives in months or takes longer, security teams have good reason to make sure those devices aren't being overlooked.
For another look at growing AI safety concerns, read why a former Anthropic researcher warned that the race to develop more powerful models could outpace efforts to keep them under control.