An AI on 15 TV boxes: what Anthropic's test means for your company network

TL;DR. On October 12, Anthropic's Frontier Red Team published a study that asks an uncomfortable question: can a small, freely available AI model copy itself onto cheap devices, without any data center? Not quite yet. But a model with 9 billion parameters got itself running on 8 of 9 hardware types, and in a simplified test network an open model spread to all 8 machines in 4 of 5 runs. Anthropic expects small models to reach this level by the end of 2026. That moves an old question to the front: which cheap devices are connected to your network, and who looks after them?

What Anthropic tested

To spread on its own, a model has to do four things: find targets, get access, get itself running on the foreign device and move on from there. The team deliberately kept the break-in simple. It mainly studied the third step, where small models have failed so far: piecing together the right software on unfamiliar hardware and setting up an AI service. The results according to Anthropic's report:

• Runs almost anywhere. The open model Qwen3.5-9B set up an AI service by itself on 8 of 9 hardware types, from the Jetson Nano hobby board to the Mac.
• 15 TV boxes as one computer. A larger model with 26 billion parameters ran split across 15 no-name Android TV boxes at about 55 dollars each, with 4 GB of memory apiece.
• The whole chain in the test network. In an isolated network of 8 cloud machines running emulated Android, only the model GLM-5.2 managed everything on its own: all 8 machines in 4 of 5 runs, 7 in the fifth.

On top of that, the models learn as they go. When Qwen3.5-9B received the notes from earlier attempts, its setup success rate rose from 45% in the first round to between 61 and 84% in later ones.

The fine print

• The break-in was a gift. The test devices had an open maintenance port without a password. Anthropic itself therefore calls the results an upper bound.
• Capable enough and small enough do not meet yet. GLM-5.2 completes the chain but is too large for a TV box. The models that do fit still make mistakes when chaining the steps together. In Anthropic's own words: “We don’t yet have a full rogue replicator.”
• It is slow. At TV-box speed, a single copy would take an estimated 28 to 51 hours with the 9-billion model and 71 to 150 hours with the 26-billion model. A swarm of two million boxes, the size of the Kimwolf botnet, would add up to the computing power of about 40 H100 graphics cards.
• “End of 2026” is a projection from the past performance gains of small open models, not an observation. BleepingComputer also points out that no autonomous AI worm was shown on real devices.

Why it still matters

Slow does not mean harmless. Anthropic compares such a swarm to a slime mold: it grows over days, and there is no central switch to turn it off. Classic botnets are tailored to specific devices. A model that pieces together its own software is not. As possible targets, the study names smart TVs, cameras and video-conferencing systems with built-in AI chips, and the network storage boxes of small businesses, which are already popular with ransomware gangs today.

On October 13, more than 400 researchers, among them Geoffrey Hinton, also called in an open letter for models with hacking capabilities to be cut off from the internet by default, and for every escape from a test environment to be reported to an international body.

What this means for a mid-sized company

The device from the test is already in many companies: the cheap Android box behind the screen at reception, in the cafeteria or in the meeting room. Since October 2024, Germany's Federal Office for Information Security (BSI) has been redirecting the traffic of infected devices of this kind to its own servers and counting them. In August 2026, 55.3% of the infected connections it saw belonged to a single botnet: BadBox. The malware ships in the firmware of Android devices such as media players and digital picture frames, and according to the BSI it was already on the device at purchase in every known case.

The good news is in Anthropic's study itself: an AI swarm would be noisy. Model files of several gigabytes, constant device-to-device traffic and scans across the network stand out if someone is watching. With the Mirai botnet, one internet provider cleared 92% of infections within 14 days by isolating and notifying affected customers. Without notification, it was 74%.

If you build connected products yourself, you have had one more duty since September 11, 2026: under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities, with the first warning due within 24 hours. The remaining obligations, such as handling vulnerabilities over a product's entire lifetime, apply from December 11, 2027.

What you should do now

1. Count your devices. List everything on the company network that is not a work computer: TV boxes, cameras, conferencing systems, network storage, printers, controllers. The BSI advises disconnecting affected devices from the internet or no longer using them.
2. Isolate the devices. Such devices belong in a separate network, without access to servers and without connections to each other. Change default passwords and close open maintenance ports.
3. Watch for anomalies. Have your firewall or router alert you when a device suddenly downloads gigabytes or probes other devices on the network. That is exactly how an AI swarm would show itself.
4. Ask about updates when buying. Only buy connected devices with promised security updates, and get the period in writing.
5. As a manufacturer, set up the reporting path. If your machines or products are connected: who reports an exploited vulnerability within 24 hours, and where?

The study does not show an attacker yet, but a direction. The precautions against it are old and unspectacular, and they work just as well against today's botnets. If you would like to go through your device list with someone, feel free to get in touch.