Anthropic warns small AIs could self-replicate on your TV box and oven

On 13 October 2026, Bleeping Computer relayed a warning from Anthropic. According to the company, small AI models may be only a few months away from copying themselves, unaided, onto consumer smart devices, from no-name Android TV boxes to connected ovens. The result would be a new breed of botnet, able to run AI without a single datacenter. Your oven, which has been flashing 12:00 since the day it was installed, could end up as a compute node.

What Anthropic actually tested

The experiment used cheap Android TV boxes and five models, each with its own part to play. Qwen3.5-9B and GLM-5.2 were cast as the agents: their job was to install and spread Llama3.1-8B, which handled inference. Gemma4-26B-A4B, from Google DeepMind, was used to show that a model can run split across fifteen boxes. Opus 4.8, a more powerful model, was tested separately as an adviser to Qwen.

One detail matters: the playing field was simplified. The targets exposed ADB access with no authentication. That’s less a locked door than one with the key left in it and a welcome mat out front. Within that setup, the models managed to find devices they had never seen before, network them together and get them ready to run a model.

Scores going up, timelines that buy some breathing room

Qwen3.5-9B installed and configured everything needed to run Llama3.1-8B on eight of the nine hardware types tested. In an emulated, controlled network, GLM-5.2 reached all eight nodes in four out of five runs. The other models did not reliably see the process through. When data from previous attempts was kept, Qwen3.5-9B’s success rate climbed from 45% at the start to 84% in later generations.

The big sibling, meanwhile, changed nothing: bringing in Opus 4.8 as an adviser produced no measurable improvement. If you have ever watched a senior consultant parachute into a crisis call, you will recognise the outcome.

Above all, it is slow. On the hardware studied, getting inference up and running takes 28 to 51 hours for Qwen3.5-9B, and 71 to 150 hours for Gemma4-26B-A4B. Anthropic talks of a doubling time in the order of a few days, which leaves defenders time to spot the attack and respond.

What the warning says about worms to come

A replicator like this would be hard to stop, because it has no central off switch: no single point to cut. Its current sluggishness is no guarantee either, since those timelines could collapse with the next generation of models. Based on its results and the past pace of progress, Anthropic estimates that models of 30 billion parameters or fewer could reach the required level by the end of 2026.

Still, read the warning all the way to the end. The team did not demonstrate a fully autonomous self-replicating worm on real IoT hardware. Even with safety settings dialled down and an explicit goal to spread, the full chain never came together. So the threat is not imminent. And here is something rare enough in AI news to deserve a mention: an announcement that tells you, unprompted, what didn’t work.

Defence, on the network and at the factory

The proposed countermeasures are refreshingly unglamorous. Watch for large model transfers and unusual device-to-device traffic, set up honeypots to inspect what attacks are carrying, quarantine infected subscribers, and improve the default security settings of connected devices. That last point targets exactly the weakness that made the experiment possible.

Tomorrow’s worm may ship with its own language model, but it will still get in the old-fashioned way: through a door the manufacturer left on the latch.