Anthropic Red Team Runs a 26-Billion-Parameter Model Across 15 Cheap Android TV Boxes and Reports "Signs of Life for AI Worms"

Anthropic's Frontier Red Team published a study on October 12, by William Zhou and Daniel Freeman, that asks whether small language models can copy themselves onto cheap, poorly protected devices without a data center. The answer they report is "not yet, but closer." The Financial Times reported the work on October 14 with Anthropic's line that it is "seeing signs of life for AI worms."

The most concrete result is a distributed inference test. According to Let's Data Science's summary of the paper, the team split Gemma4-26B-A4B, a sparse model with about 4 billion active parameters, across 15 off-brand Android TV boxes that cost about $55 each and got 0.39 tokens per second. A 9-billion-parameter model configured its own inference stack on eight of the nine hardware types tested. In a firewalled network, GLM-5.2 reached all eight target nodes in four of five trials, and seven nodes in the fifth, while setting up an inference server for a smaller model.

The researchers are explicit about the limits. No complete, uncontrolled replicator exists, and the open question is whether a model can finish the entire chain, from initial access through persistence and onward spread, against real security controls. CBS News quotes Anthropic's view that small models may be "months away" from that capability. CBS also reports the researchers' point that a worm of this kind has "no centralized point to shut off." On low-power devices, the researchers expect a slow-growing distributed system with a doubling time measured in days.

Two parts of the study matter for engineers. First, both models in the headline experiments are open-weight, one from Google and one from Zhipu, so the capability sits outside any lab's usage policy once the weights are published. Second, 0.39 tokens per second is too slow for interactive use but fast enough for an agent that has days to act. The threat model depends on patience and the number of compromised devices, not on speed. Anthropic sells closed models and gains from a public perception that open weights are dangerous, so readers should note that this is a vendor's own threat research and has not been replicated.