# Anthropic Red Team Runs a 26-Billion-Parameter Model Across 15 Cheap Android TV Boxes and Reports "Signs of Life for AI Worms"

In a firewalled test, the open-weight GLM-5.2 reached all eight target nodes in four of five trials while setting up inference servers, though Anthropic says no complete self-replicating agent exists yet.

- Published: 2026-10-15T06:37:42.045Z
- Canonical: https://polylog.news/ai/2026-10-15/anthropic-red-team-runs-a-26-billion-parameter-model-across
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [Anthropic Frontier Red Team](https://www.anthropic.com/research/team/frontier-red-team), [CBS News](https://www.cbsnews.com/news/ai-worms-smart-devices-anthropic/), [Let's Data Science](https://letsdatascience.com/news/anthropic-evaluates-ai-self-replication-on-iot-devices-263c5633)

Anthropic's [Frontier Red Team](https://www.anthropic.com/research/team/frontier-red-team) published a study on October 12, by William Zhou and Daniel Freeman, that asks whether small language models can copy themselves onto cheap, poorly protected devices without a data center. The answer they report is "not yet, but closer." The [Financial Times reported the work](https://t.me/aipost/8483) on October 14 with Anthropic's line that it is "seeing signs of life for AI worms."

The most concrete result is a distributed inference test. According to [Let's Data Science's summary of the paper](https://letsdatascience.com/news/anthropic-evaluates-ai-self-replication-on-iot-devices-263c5633), the team split Gemma4-26B-A4B, a sparse model with about 4 billion active parameters, across 15 off-brand Android TV boxes that cost about $55 each and got 0.39 tokens per second. A 9-billion-parameter model configured its own inference stack on eight of the nine hardware types tested. In a firewalled network, GLM-5.2 reached all eight target nodes in four of five trials, and seven nodes in the fifth, while setting up an inference server for a smaller model.

The researchers are explicit about the limits. No complete, uncontrolled replicator exists, and the open question is whether a model can finish the entire chain, from initial access through persistence and onward spread, against real security controls. [CBS News](https://www.cbsnews.com/news/ai-worms-smart-devices-anthropic/) quotes Anthropic's view that small models may be "months away" from that capability. CBS also reports the researchers' point that a worm of this kind has "no centralized point to shut off." On low-power devices, the researchers expect a slow-growing distributed system with a doubling time measured in days.

Two parts of the study matter for engineers. First, both models in the headline experiments are open-weight, one from Google and one from Zhipu, so the capability sits outside any lab's usage policy once the weights are published. Second, 0.39 tokens per second is too slow for interactive use but fast enough for an agent that has days to act. The threat model depends on patience and the number of compromised devices, not on speed. Anthropic sells closed models and gains from a public perception that open weights are dangerous, so readers should note that this is a vendor's own threat research and has not been replicated.

## What this means

The exposure runs through two channels. The first is consumer Internet of Things (IoT) hardware: cheap Android boxes and similar devices, mostly white-label products from Chinese supply chains, now count as usable compute for an attacker who brings an open-weight model. That gives regulators a stronger case for device-security mandates and import scrutiny. The second is open-weight release policy, because the study gives labs and governments that favor gated access a specific example to point to. The market already prices AI-driven demand for endpoint and network security. It does not price liability for device makers, and that is the new element. The consensus framing of "rogue AI" misses the more likely near-term case, which is a human operator using a small model as the payload of an ordinary botnet. The likelier outcome within months is that a security vendor or academic group reproduces part of this chain in the wild, followed by regulatory calls in the EU and US to restrict open-weight releases above some capability level. That depends on independent replication. It would be proven wrong if follow-up work shows that standard network segmentation and firmware signing reliably stop the self-installation step.

## What to watch

- Whether any incident-response firm reports a botnet that carries a language model as its payload. That would move the threat from lab result to field observation.
- Whether Zhipu or Google change license terms or release practice for small open-weight models after being named in the study. A change would show that vendor threat research can alter release decisions.
- Whether EU or US device-security regulators cite AI self-replication in rules for connected consumer hardware. That would shift cost onto low-cost device makers.