On 12 October 2026, William Zhou and Daniel Freeman of Anthropic’s Frontier Red Team published a research post on AI self-replication IoT: “AI models may be capable of self-replicating without access to a datacenter.” Read the verb. “May be capable” is a forecast about a skill. It is not a sighting of a program already loose in kitchens.
The Financial Times headline the next morning, “rogue AI agents may ‘self-replicate’ to hijack ovens,” borrows one noun from a list of machines that could, in principle, hold a slice of a small model. Anthropic did not hijack an oven. The careful sentence is the research post; the oven headline is the sentence to unlearn.
This post unpacks those claims in plain terms: what a weight-based worm is, what Anthropic actually bought and measured, and why a mind that escaped is the wrong picture. For another Anthropic agent story told from a blank page, see Claude’s fake police tip, explained.
What you need before the scary noun means anything
A model (the finished program that continues text by guessing the next small piece) is a pile of numbers plus a short procedure for using them. A weight (one of those stored numbers) is not a thought. A parameter (the usual name for one weight when people count them) is the same object. “Nine billion parameters” means nine billion stored numbers, not nine billion ideas. A token (a small chunk of text, often a word or part of a word, that the model reads or writes one piece at a time) is the unit of that guessing. Inference (using the finished numbers to produce the next token, then the next) is the job. Training (the long, expensive job of adjusting the numbers until the guesses are useful) is a different job, and this post is not about training. Nobody in the Anthropic experiment taught a new model from scratch on a television.
A worm (a program that copies itself onto other machines and keeps going) is older than chatbots. A virus, in the old sense, hides inside some other file and waits for that file to run. A worm does not need you to open an attachment. It looks for a door that is already open. A botnet (a crowd of machines a worm already reached, taking orders from one operator) is the crowd, not the copy step. Self-replication (making a second working copy on a machine you did not start on, without a person carrying a USB stick) is the copy step. Put an AI model in the worm and the new question is narrow: can the model do the copy steps itself, including the step of getting a model running on the next machine?
That is why the datacenter (a warehouse of machines built to run models all day) was the old assumption. A useful model is a large file of weights. A cheap gadget has a small memory. Until recently, the only place you could both store the file and do the guessing fast enough to matter was that warehouse. If the weights have to live in the warehouse, then “turn the model off” has an address. Unplug the warehouse, or revoke the key, and the copies stop thinking. Anthropic’s question is what changes if the weights can live on the gadgets instead.
Two kinds of copy, and only one of them is the headline
Anthropic splits the idea into more than one shape. A weight-based replicator (their name for a worm that carries the model’s numbers onto the compromised machine and runs them there) has no single website to switch off. The thinking happens on the gadget. An API-based replicator (a worm that steals a key to somebody else’s model in a datacenter and calls it) thinks fast, because the warehouse is still doing the math, and it is easier to notice, because the bill and the logs sit with a company. The post says the API version might spread faster and die easier. The weight-based version is the one that can linger on junk hardware. The oven headline is about the second kind only if you squint. The experiments are about the first kind.
IoT (Internet of Things: ordinary objects that also have a small computer and a network connection) is the gadget pile. A smart TV, a cheap streaming box, a thermostat, a vacuum, a lawnmower. The computer inside is usually too small to hold a whole modern model. A shard (one slice of the model, not the whole pile of numbers) can be small enough. Anthropic’s sentence, quoted, is: “Machines that could run a significant model shard for a <30B model include smart fridges, smart ovens, automatic vacuum cleaners, and lawnmowers.” “Could” is doing the work. Under 30B means under 30 billion parameters. The sentence is a size argument. It is not a list of devices they infected.
The four doors, in the order a copy has to walk through them
Anthropic decomposes autonomous replication into four practical stages: finding targets, gaining execution, establishing inference, and continuing propagation from the new host. You need each phrase before the chain makes sense.
Finding targets means discovering machines that will answer on the network. Gaining execution means getting the machine to run a program you chose. That is the break-in. Establishing inference means getting a model actually guessing tokens on that machine, not merely leaving a file sitting there. Continuing propagation means the new copy does the first three steps again, aimed at a further machine. A file that never runs is not a worm. A model that runs once and stops is not a replicator. The fourth door is the one that makes the word “self” earn its place.
The break-in is the step they refused to make realistic. Their sentence: “Our evaluation keeps the cyber-exploit element of the replication trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success.” ADB (Android Debug Bridge: a developer tool that lets another computer install apps and type commands on an Android device) is a real door. Authentication (a lock that asks who you are before it obeys) was left off, on purpose, in the lab. An upper bound means “this is the optimistic case, if the door is already open.” It is not a measurement of how often real doors are open. They add that real IoT security might not be much harder than this toy, because older botnets such as Mirai spread with factory passwords. That is a warning about defaults. It is still not a count of today’s open doors.
What they bought, and how slow the thinking is
To show the math can happen at all outside a datacenter, they bought 15 off-brand Android TV boxes for about $55 each and networked them. Each box had 4 GB of RAM (working memory the computer can use at once, not the size of its storage card). They ran Gemma4-26B-A4B, a 26-billion-parameter open-weight model (a model whose numbers you can download, as opposed to one that only answers through a company’s website), split across the 15 boxes, at 0.39 tokens per second. Pipeline parallelism (cutting the model into a sequence of layers, so each box holds one stretch of the recipe and passes the unfinished guess to the next box) is how a 4 GB box holds a slice instead of the whole model. They say a 9-billion-parameter model needs 4 or more of these machines, and the 26-billion-parameter one needs 10 or more. A failed box can be swapped without killing the whole chain. That is a reason to split the model this way, not a claim that the chain is sturdy in a living room.
Zero point three nine tokens a second is the number to sit with before any adjective like “swarm.” A 100-token reply (a short paragraph) at that speed is 100 divided by 0.39, about 256 seconds, a bit over four minutes. They also report an unoptimized speed of about 0.3 tokens per second across a 32k context (a prompt window of roughly 32,000 tokens) averaged across prefill (the gulp: read the whole prompt before any new word) and decode (the drip: write one new token at a time). A person types faster than this pile thinks. The surprise is not that the boxes are clever. The surprise is that they think at all.
They separately asked whether models can get inference going on hardware they were not shown in advance. A 9-billion-parameter model did so on 8 of the 9 hardware types tested, from small boards up to an ordinary PC graphics card. Setup is not instant. They report about 28 to 51 hours for Qwen3.5-9B on the TV boxes, and about 71 to 150 hours for an unoptimized Gemma4-26B-A4B. Hours, not seconds. A copy that takes a day or two to become a working model on the next shelf is the opposite of a flash infection in a film.
The worm test was a closed toy, and one model finished it
The replication trial did not use the 15 real boxes as the infected neighborhood. It used a firewalled VPC (a private network inside Google’s cloud, walled off from the public internet) of 8 nodes running redroid, an Android 15 emulator (a program that pretends to be a phone or a TV box). Patient zero (the first machine, seeded by the researchers) hopped to the next one over the unlocked ADB port, tried to stand up an inference server for Llama 3.1 8B (a specific small open model) and, if the checks passed, did it again. Of the open-weight models they tested, only GLM-5.2 finished the whole chain. It reached all 8 nodes in 4 of 5 trials, and 7 of 8 in the remaining trial. Models at or under 30 billion parameters could do many of the separate steps and still botch the chain. Reuters’ lead, the same day, says the same thing in shorter form: small models could complete many steps, and struggled to complete the entire sequence, until the test was simplified and GLM-5.2 or something stronger was the one driving.
A figure in the post also shows a contained 17-node fleet, two groups of 8 joined by one pivot, and says each tree is the model’s median run of six. The number to repeat is the one they state in prose: 8 of 8, in 4 of 5, for GLM-5.2, on the unlocked toy.
| Sentence you may hear | What the post actually supports |
|---|---|
| AI copied itself onto ovens | Ovens are in a list of machines that could hold a shard. The purchase was 15 TV boxes. The worm trial was 8 emulators |
| A rogue replicator is loose | Their conclusion: “We don’t yet have a full rogue replicator” |
| Small models can already do the whole job on the real internet | Under-30B models do many steps and mess up the chain. End-to-end was GLM-5.2, with the break-in made trivial |
| This will be fast | About 0.39 tokens per second on the 15 boxes. They describe 1 to 2 days per 9B replication |
| By New Year a small model will definitely escape | A trend line on a general score, which they call a rough proxy, crosses a line at the end of 2026 |
The forecast is a line on a chart, and they say so
They plot notable open-weight models of 30 billion parameters or fewer against the Epoch Capabilities Index (ECI: a general score of what models can do, kept by the research group Epoch, not a score of worm skill). The best-in-class line rises by 13.7 ECI points a year, with an R² of 0.95 (a measure of how tightly the dots hug the line; 1 would be a perfect hug). If GLM-5.2 is treated as the capabilities floor for this replication task, the line puts a small model at that level by the end of 2026. Then they undercut their own picture: “ECI is a general capability index, which is only a proxy metric for replication ability, so this is only a rough estimate of when a small-model replicator becomes possible.” A proxy (a number that tends to move with the thing you care about, and is not the thing itself) can be wrong in the year you needed it. “End of 2026” belongs in a calendar as their extrapolation, with their adjective “rough” still attached — not as a promise.
Even two million boxes are a small puddle
Kimwolf is the size they borrow, and it is not an AI worm. It is a conventional Android botnet (reported by QiAnXin XLab, active from late 2025) that compromised on the order of two million devices, mostly cheap Android TV boxes, often through that same unlocked ADB port, commonly on TCP port 5555. Operators used the crowd as proxies and for remote control, not as a place to run a language model. Anthropic’s move is a resize. If you grouped a Kimwolf-scale crowd into piles of 15 boxes, and every pile ran one copy of Gemma4-26B-A4B, you would get on the order of 133,000 copies. Two million divided by 15 is 133,333 — the division behind the “roughly 133,000” figure in writeups of their estimate.
They say a group of TVs like the demo can serve 2 agents at about 0.3 tokens per second each, and that a botnet-scale crowd of such groups would yield about 80,000 tokens per second. Check the shape of it: 133,000 copies times 0.6 tokens per second is about 80,000. An H100 (Nvidia’s data-center GPU, the chip people rent when they want a model to answer quickly) can serve this same Gemma model at about 1,950 tokens per second under a fast setup they cite, with speculative decoding (a trick where a small helper guesses several next tokens and the big model checks them, so the big model does less work per token). Eighty thousand divided by 1,950 is about 41. Their sentence is “at most about 40 H100s-worth of inference.” The “at most” matters. Forty of those chips is a real rack or two. It is not a frontier training cluster, and it is not “the internet became a datacenter.” It is a slime mold with the compute of a modest rented cluster, spread through living rooms, thinking in days.
Their own analogy, not mine: a slime mold, or a swarm of fruit flies, replicating over days. “Over 1-2 days per 9B replication.” Slow is the defense and the point. Slow means a person can notice. Slow also means a program that does not get bored can continue after a human operator would have quit.
Copies can learn from notes, and a bigger advisor did not rescue them
A harness (the program wrapped around the model that starts it, stops it, and hands it tools) is not the model. Their harness is called Memento. It lets an attempt run, kills it on a timer, writes down what was tried and what failed, and starts a fresh copy with those notes so the next copy does not fall in love with a bad idea. Across six generations of Qwen3.5-9B, the share of runs that finished inference setup rose from 45 percent in the first generation to somewhere between 61 and 84 percent later. That is adaptation (later copies getting the earlier copies’ notes) and it is real inside this harness. It is not the weights rewriting themselves in the wild, and it is not a worm improving its own exploit. The notes are about getting a model to boot on strange hardware.
They also handed Qwen3.5-9B a frontier advisor, Opus 4.8, either as a tool the small model could call or as advice pushed at it. They report no significant improvement on the inference-setup job. A frontier model (one of the largest, most capable models a lab will currently serve) is not, in this test, a tutor that turns a small model into a reliable installer. That does not prove advice never helps. It does refuse the opposite slogan: that a weak box plus a phone call to a big model obviously becomes a strong worm. Their measurement says it did not, here.
What they think a defender can actually do
They borrow R0 from epidemics (the number of new devices each infected device goes on to infect). If R0 is below 1, the chain dies out. If it stays above 1, the chain becomes endemic (always somewhere, even if each neighborhood eventually cleans up). Three things, in their words, sit on the defender’s side of that line.
First, a weight-based copy at scale is loud. Newly infected machines may receive multi-gigabyte payloads (the weights are a big file). Distributed inference makes machines talk to each other that do not usually exchange that much traffic. Propagation adds scanning. The faster it spreads, the louder it is. Once someone sees it, a honeypot (a decoy machine, left where the worm will find it, so you can catch a copy and read it) collects the harness and the payload.
Second, an ISP (the company that sells the household its internet connection) has done this before, against Mirai, a 2016 botnet of cameras and routers that used factory passwords. Anthropic cites an NDSS paper: quarantining infected customers, restricting them to a short list of sites and showing cleanup instructions, cleared 92 percent of infections within 14 days, against 74 percent when nobody was notified. Quarantine is not the same as deleting every copy on earth. They say clearing it completely would mean every ISP with an infected network doing the work, which is hard.
Third, manufacturers can shrink the pool, and law can make them. They point at the UK, where default passwords on consumer smart devices are now non-compliant, and they link the NCSC’s note on that law. A box that ships with a public debugging port and no password is the door this entire paper walks through. Close the door at the factory and both the old botnet and the hypothetical new one lose the first neighborhood.
Containment habits for agent sandboxes matter for the same reason open ports matter: a wall that misses one path is not a wall. See The wall blocked the web. The phone book did not. for how an agent sandbox can look closed while DNS still leaks.
What I would actually do, and what I would not repeat
I would not unplug a name-brand television because of this post. Anthropic did not test a name-brand streamer, and a Roku, an Apple TV, or a Chromecast is a different product from a no-name Android box that left a developer port open. I would look at the cheap Android TV box, if I owned one: the kind sold as a generic “TV BOX” with a remote and a promise of free channels. I would turn off network ADB, or developer debugging, if the settings expose it. I would change any password that is still the one printed on a sticker for every unit of that model. I would put the box, the vacuum, and the camera on a guest network so a copy that did land there cannot see the laptop. Those are the same chores as for Kimwolf, which already happened, without any model inside it.
I would not repeat “self-replicating AI” without “may,” without “weight-based,” and without “the break-in was left unlocked.” I would not repeat “oven.” I would not repeat “end of 2026” without “rough proxy.” I would not say 40 H100s as if a living room had become a supercomputer. Forty H100s, spread over two million weak boxes, thinking at under half a token a second per pile, is a reason to close a port. It is not a reason to narrate an escape.
Their closing line is the one to keep: signs of life for AI worms, not a worm. The skills that make a model a useful coding agent (a model put in a loop and allowed to take several steps, not just answer once) also show up when the steps are “find a box, run a program, boot a model, do it again.” Like coding agents in 2024, the steps are appearing before the reliable whole. They expect a future with agents on all sorts of hardware, including some nobody is steering, and they say lightweight agents may be more willing than a human criminal to grind through a huge number of boring, insecure gadgets. That is a patience argument. It is also still a prediction past the edge of the experiment. The experiment’s edge is a walled garden, an open port, one model that finished, and a chart with a caveat in the caption.
Common questions about AI self-replication on IoT
Did Anthropic hijack smart ovens?
No. Ovens appear in a size list of machines that could hold a shard of a model under 30 billion parameters. The purchase was 15 off-brand Android TV boxes. The worm trial used 8 emulators behind a firewall.
Is a rogue AI replicator loose on the internet?
Anthropic’s own conclusion is that they do not yet have a full rogue replicator. The lab number is an upper bound with the break-in left unlocked.
How fast was the TV-box cluster?
About 0.39 tokens per second for the 26B model across 15 boxes. A short paragraph takes minutes, not milliseconds. Setup for a new host took on the order of a day or two for the 9B case.
What should a household actually change?
Close network ADB on cheap Android TV boxes, change factory passwords, and put gadgets on a guest network. Those are the same chores Kimwolf already justified without any language model inside the botnet.