Can AI Really Copy Itself Onto Your Smart TV? What Anthropic's Test Showed

This week's headline sounds like science fiction: Anthropic says small AI models could soon copy themselves onto smart TVs and fridges. If you own a cheap streaming box, run a home lab, or manage a network full of connected devices, the useful question isn't whether this is scary. It's this: what did Anthropic's experiment actually show, and does it change what you should do about the devices already in your home?

The short answer

No AI worm has been found in the wild, and Anthropic says so itself. What its Frontier Red Team showed on October 12, 2026 is narrower: in simplified tests, one open-weight model completed every step of self-replication, and smaller models can already do many of the steps on their own. The test made the hacking part trivial on purpose. In the real world, though, that same weakness, an Android debug port left open, has already been used to build a two-million-device botnet. So the AI part is still a forecast. The insecure hardware is already here, and that is the part you can fix today.

What Anthropic actually tested

The research post, "AI models may be capable of self-replicating without access to a datacenter" by William Zhou and Daniel Freeman (Anthropic, October 12, 2026), is about what the authors call weight-based replicators: "autonomous worms that run their models directly on compromised hardware." Today's AI agents depend on a data center somewhere. A weight-based replicator would carry its own model, so there would be no single server to switch off.

The team ran three kinds of experiments, and they're easy to mix up.

1. Can a model run on junk hardware at all?

Yes, slowly. The team split Google's open-weight Gemma4-26B-A4B across 15 off-brand Android TV boxes that cost about $55 each and have 4GB of RAM apiece. The cluster generated roughly 0.39 tokens per second. In a separate test, a 9B-parameter model got inference running by itself on 8 of the 9 hardware types tried, from Jetson boards to Orange Pis. A full inference setup took the agents 28 to 51 hours with Qwen3.5-9B and 71 to 150 hours with Gemma4-26B-A4B, according to the post's own figures.

2. Can a model do the whole replication loop?

This is the headline result, and it comes with conditions. Anthropic built a firewalled network of 8 Google Cloud nodes running redroid, an Android 15 emulator. The worm moved "node to node over an unauthenticated ADB port" and set up a Llama3.1-8B inference server on each machine it reached. GLM-5.2 was the only open-weight model that did this end to end. It reached all 8 nodes in 4 of 5 trials and 7 of 8 in the fifth. The post says the other models "fail reliably." Two details matter here. The nodes were emulators, not physical TVs. And the worm's own model ran on a separate inference server, because the nodes were too small to host it.

3. Are small models getting there?

Anthropic's forecast rests on this part. The authors plotted small models on the Epoch Capabilities Index and measured a gain of about 13.7 points per year (R² of 0.95). If GLM-5.2's level is the bar for replication, they write, small models "will match this capability level by the end of this year." They also tested a harness called Memento that restarts an agent with notes from earlier attempts. With it, Qwen3.5-9B's success at setting up inference rose from 45% in the first generation to between 61% and 84% in later ones.

Why critics say the test was stacked

The pushback came quickly. Fortune reported on October 13, 2026 that Gregory Kurtzer, founder of Rocky Linux and CEO of CIQ, objected that the researchers' own software launched the AI programs, that the programs were explicitly told to spread, and that access to the targets was deliberately left unauthenticated.

Most of that matches what Anthropic disclosed. The post says the evaluation "keeps the cyber-exploit element of the replication trivial" and calls the result an upper bound on real-world success. It also says the capability trend is only a proxy for replication ability, and that it didn't test whether an AI botnet could outmaneuver defenders. "Months away" is an extrapolation from a trend line, not a measurement.

Why the "trivial" part isn't that comforting

Critics are right that an open debug port is the easy case. The trouble is that the easy case is common. On January 2, 2026, Brian Krebs reported that the security firm Synthient was tracking more than 2 million devices infected by the Kimwolf botnet. About two-thirds were Android TV boxes with no security or authentication built in. Kimwolf reached devices behind home routers through residential proxy services, and a device's local address on port 5555, the network port Android Debug Bridge uses, could give unrestricted administrative access.

Anthropic used Kimwolf as its yardstick. In an equally large fleet of infected TVs, if every group of 15 ran a copy of Gemma4-26B-A4B, the authors estimate about 133,000 replicas generating roughly 80,000 tokens per second, about what 40 H100 data-center GPUs could serve. That's a lot of copies but very little compute, and the authors expect the spread to be slow, "with a doubling time of days." The likely risk isn't a superintelligence on your TV. It's a persistent swarm of mediocre agents that is hard to stamp out, because "there's no centralized point to shut off."

What actually helps

Anthropic's defensive advice is aimed at internet providers, manufacturers and regulators, not consumers. It suggests ISPs watch for multi-gigabyte model transfers and device-to-device traffic, run honeypots, and quarantine and notify infected customers. That last idea has evidence behind it. A NDSS 2019 study by Çetin and colleagues found that quarantining Mirai-infected customers in a walled garden and notifying them cleared 92% of infections within 14 days. In control groups that got no notice, 58% to 74% of infections cleared on their own. The post also points to secure defaults. The UK has required since 29 April 2024 that consumer smart devices ship without universal default passwords.

For your own devices, the checklist is ordinary security hygiene. These are our recommendations, not Anthropic's:

• Be wary of no-name Android TV boxes. They're the device class behind both Kimwolf and Anthropic's demo. Choose hardware from a vendor that publishes how long it will ship security updates.
• Turn off developer options and network ADB on any Android device where you've turned them on, and don't forward port 5555 through your router.
• Put smart-home gear on a guest or separate network so one compromised box can't easily scan the rest of your devices.
• Watch for unexplained traffic. A TV box that suddenly uploads gigabytes is the signal Anthropic says ISPs should look for, and many home routers show per-device usage.

What we know vs. what we're inferring

• Known (Anthropic, Oct 12): GLM-5.2 replicated end to end across 8 emulated nodes in 4 of 5 trials, with an unauthenticated ADB port and the agent model on a separate server. A 26B model ran across 15 real TV boxes at about 0.39 tokens per second.
• Known (Krebs, Jan 2): Kimwolf infected more than 2 million devices, mostly Android TV boxes, through local administrative access on port 5555.
• Known: Anthropic says it has no full rogue replicator and that its results are an upper bound.
• Inferred by Anthropic: small models could reach the replication bar by the end of 2026, if their historical rate of improvement holds.
• Our inference: the near-term risk depends more on how much insecure, unpatched hardware stays online than on any single model release. Fixing that hardware is worth doing whether or not the forecast comes true.

What to watch next

• December 31, 2026: the date Anthropic's trend line points to. Check whether new open-weight models of 30B parameters or fewer reach GLM-5.2's level on the Epoch index.
• Independent replication: whether other labs or academics rerun the end-to-end test on physical devices with a realistic exploit step instead of an open port.
• EU rules: the Cyber Resilience Act's duty to report actively exploited vulnerabilities took effect on 11 September 2026, and its broader product-security requirements follow on 11 December 2027. Watch for the first reports involving TV-box firmware.

Educational information only. This article summarizes published research and reporting as of October 14, 2026, and is not security, legal or financial advice.