Anthropic: self-replicating AI could run on $55 IoT boxes

Self-replicating AI does not need a data center. That is the core finding of new research from Anthropic's Frontier Red Team, published October 12. The team ran a 26B open-weight model split across 15 off-brand Android TV boxes, about $55 each, and tested whether small models can find hardware, set up inference, and copy themselves to the next device. Their estimate: small models may be "months away" from doing that end to end on commercial IoT devices.

What actually happened

The researchers tested four stages of a "weight-based replicator": find targets, get execution, set up inference, and spread. They mostly set aside the exploit step and used an unauthenticated ADB port as a deliberately easy way in, so they call their results an upper bound.

Key numbers from the post:

• Gemma4-26B-A4B ran across 15 TV boxes with 4GB of RAM each, at roughly 0.3 to 0.4 tokens per second. Slow, but it runs.
• A 9B model got inference working on 8 of 9 hardware types, from Jetson Nanos to Macs.
• GLM-5.2 was the only open-weight model that replicated end to end, reaching 8 of 8 nodes in 4 of 5 trials on a firewalled test fleet.
• Qwen3.5-9B improved from 45% inference-setup success to 61–84% when each generation passed notes to the next.
• On a capability trend line, a small model could reach GLM-5.2's level by the end of 2026. The authors call that trend a rough proxy.

The spread they model is slow, with a doubling time in days. The defenses they recommend are old-school: watch network flows for multi-gigabyte model transfers and unusual device-to-device traffic, quarantine infected subscribers, and ship devices with secure defaults.

Why it matters for your business

Most small offices have this exact hardware. The cheap streaming box on the break-room TV. The camera DVR. The smart plug a contractor put in. These devices were already botnet recruits for DDoS and proxy traffic. This research says the next tenant might be a model that uses your power and bandwidth to think and spread.

The fix is not AI-specific, which is good news. Put IoT devices on their own VLAN or guest network, away from the machines that hold your customer data. Turn off debug services like ADB. Replace off-brand boxes that never get updates. And set an alert on your router or firewall for sustained outbound traffic from devices that should only stream video.

Sources: Anthropic Frontier Red Team.