Anthropic ran a self-copying AI across 15 cheap TV boxes for $825

A small bar for an AI worm is being able to install itself on a stranger's hardware without being told how. Anthropic says a model at the capability level of GLM-5.2 can already do that most of the time.

In a paper published on 12 October, Anthropic Frontier Red Team researchers William Zhou and Daniel Freeman describe an experiment in which they built a 15-node cluster from off-brand Android TV boxes, bought for a total of $825, and ran the 26-billion-parameter Gemma4 model across them at 0.39 tokens per second. The cluster shows that lightweight AI agents can run on cheap, internet-connected devices while the agents try to install themselves on more of the same hardware.

What the paper measured

The researchers broke the task of a model copying itself into four steps: find a target machine, get in, start inference on it, and move on. In a firewalled Google Cloud environment with eight nodes running Android emulators, Anthropic says the larger GLM-5.2 model reached all eight nodes in four of five trials and seven of eight in the fifth. The smaller Qwen3.5-9B model installed a working inference server on eight of nine hardware types, including Nvidia Jetson Nanos, Macs and RTX 4090 machines. One shortcut Anthropic names on its own: an unauthenticated Android Debug Bridge port was left open on the target machines, so exploitation was easy.

Agents got better when they could read notes from earlier runs. Anthropic says Qwen3.5-9B went from a 45 per cent success rate in the first generation to between 61 and 84 per cent in later ones across 20 lineages of six generations each, by reading what the previous copy had learned. The researchers call this Lamarckian inheritance, because the model itself does not change, only the notes passed between copies.

What is still too hard

Anthropic says the gap today is that a model capable enough to copy itself reliably is too large to run on the cheap hardware it would need to spread to, and a model small enough to fit cannot yet handle the whole process. Using the Epoch Capabilities Index on open-weight models at 30 billion parameters or fewer, the researchers say the trend puts the strongest of them at GLM-5.2's level by the end of 2026. The researchers call this a rough estimate, since general capability scores are not the same thing as replication success, and the end-to-end run used favourable conditions.

The scale they draw

Anthropic uses the Kimwolf botnet, which the paper says infected more than 2 million mostly cheap Android TV boxes, as a reference point. Divided into 15-box clusters running Gemma4-26B-A4B, that would yield about 133,000 copies of the model producing a combined 80,000 tokens per second, which Anthropic says is equivalent to about 40 Nvidia H100 GPUs, except the hardware and the power bill belong to the owners of the infected devices.

What the paper says about stopping it

Anthropic names traits that could make a replicator easier to catch. Moving multi-gigabyte models between machines is loud on a network, and ISPs can quarantine infected subscribers, as happened during the Mirai cleanup, where the paper says one ISP cleared 92 per cent of its infections within 14 days. Fully eradicating a replicator would need every ISP with infected customers to coordinate.

Source

AI models may be capable of self-replicating without access to a datacenter, William Zhou and Daniel Freeman, Anthropic Frontier Red Team. Coverage by The New Stack, Amanda Caswell.