Anthropic’s Frontier Red Team ran an artificial intelligence model on a set of 15 low-cost Android TV devices, whose construction cost approximately $825, in an experiment examining how close small AI models are to being able to copy themselves across Internet-connected devices. The hardware operates at 0.39 tokens per second, a slow speed for ordinary interaction, but one that may be sufficient for software that operates without waiting for a user.
The research does not mean that Anthropic built an AI worm capable of automatically spreading across the public Internet. The experiments took place in isolated environments and included shortcuts and assumptions that made access to the devices easier. However, the results, published by researchers William Zhou and Daniel Freeman, indicate that some of the remaining technical obstacles may be temporary.
Four Links in the Replication Chain
The research identifies four tasks that a software worm needs in order to copy itself: finding a target, gaining access to it, running inference, and then moving to another device. The researchers say that smaller models have already demonstrated some of the capabilities needed for exploitation, while running the model on unfamiliar hardware, operating systems, and dependencies represents the biggest challenge.
In the tests, Qwen3.5-9B successfully set up an inference server running the Llama3.1-8B model on eight of nine types of hardware, including Jetson Nano, Mac devices, and computers equipped with RTX 4090 cards. GLM-5.2 was more reliable and achieved higher throughput, but was too large to run directly on the target devices.
In a Google Cloud environment protected by a firewall and containing eight nodes running Android emulators, GLM-5.2 reached all eight nodes in four of five attempts and seven nodes in the fifth attempt. A separate server was used to run GLM-5.2, while the worm installed a smaller 8B model on the target devices. An undocumented Android Debug Bridge port was also left open, a factor that does not necessarily reflect real-world network conditions.
Memory Improved Replication Chances
Agents’ ability to set up inference improved when later copies could read notes left by previous attempts. When Qwen3.5-9B was run across 20 lineages, each lasting six generations, success rose from 45% in the first generation to a range of 61% to 84% in later generations.
The researchers called this approach “Lamarckian inheritance,” because experience passes from one copy to another without retraining the model. Giving Qwen3.5-9B the ability to seek advice from the more capable Opus 4.8 model did not produce a statistically significant improvement, because the smaller model did not always know the right questions to ask.
What Does This Change in Practice?
The current paradox is that the model capable of carrying out the entire replication process is generally too large to run on compromised devices, while the smaller models that fit those devices do not complete the task consistently enough. The researchers estimate that TV devices with 4GB can run a 9B model distributed across four or more units, and a 26B model distributed across ten or more units. Anthropic’s cluster of 15 devices runs the Gemma4-26B-A4B model.
Setting up a single inference on this class of devices may take between 28 and 150 hours, depending on the model. However, a software agent does not need human patience, making slow propagation across huge numbers of devices a possibility distinct from conventional fast attacks.
Based on the Kimwolf network, which infected more than two million devices, most of them low-cost Android TV devices, the researchers calculated that dividing a similar number into clusters of 15 devices could produce approximately 133,000 copies of the model, at an aggregate speed of around 80,000 tokens per second. This capability is equivalent to no more than approximately 40 Nvidia H100 graphics processing units, but at the expense of devices and operating costs belonging to another party.
Limits of the Risk and Detection Methods
The results remain far from proving the existence of a self-propagating worm on the Internet. The tests relied on open ports and controlled environments, and the researchers’ estimates concerning the end of 2026 are based on general trends in model capabilities and do not guarantee comparable performance in an actual replication process.
At the same time, the propagation requirements could make this type of software detectable; transferring models several gigabytes in size between devices leaves network traffic that Internet service providers can monitor. The research indicates that isolating infected subscribers, as occurred during the fight against the Mirai network when an action by one service provider led to the removal of 92% of infections within 14 days, could be a first line of defense. However, completely eliminating the copies would require coordination among all service providers whose networks contain infected devices.