Anthropic ran a 26B model across 15 Android TV boxes, and got 0.39 tokens a second

Anthropic's Frontier Red Team ran a 26-billion-parameter model across 15 off-brand Android TV boxes, bought for about $55 each with 4GB of RAM apiece, and got 0.39 tokens a second out of the lot. William Zhou and Daniel Freeman write that the model was Gemma4-26B-A4B, that the result shows "signs of life for AI worms", and that "We don't yet have a full rogue replicator".

The report, published on October 12, splits replication into finding targets, gaining execution, establishing inference and continuing propagation from the new host. Establishing inference is the stage the team set out to measure, and the one the cheap hardware makes slow.

One model reached every node, in four of five trials

On an eight-node firewalled network of Android emulators with the debug bridge left unauthenticated, GLM-5.2 spread to 8 of 8 nodes in four of five trials and 7 of 8 in the fifth. Other open-weight models failed reliably, and in a scripted 17-node version even a 3-billion-parameter model reached about half the nodes.

The authors state the limit themselves. Keeping the exploit step trivial, they write, "makes this an upper bound on real-world success".

Setting up inference takes days, not minutes

A 9-billion-parameter model needed about 10.9 hours per 32k context window and 28 to 51 hours for a full inference setup, while Gemma4-26B-A4B needed 27.3 to 31.8 hours per window and 71 to 150 hours in full. Across six generations that each inherited the previous one's notes, success at inference setup rose from 45% in the first to between 61% and 84% later on.

Handing the agent a frontier model as an adviser did nothing for it. "The frontier model's advice doesn't measurably help," the authors write of giving the small model access to Claude Opus 4.8.

The arithmetic keeps the swarm small

Scaling from Kimwolf, a botnet of over two million devices that are mostly Android TV boxes, the team estimates about 133,000 replicas if every 15 boxes ran Gemma4-26B-A4B, yielding 80,000 tokens a second across the whole thing, or at most about 40 H100s' worth of inference. They put the doubling time of such a spread in days.

Purpose-built edge hardware is the other half of the estimate. A Jetson AGX Orin 64GB runs Qwen3-30B-A3B at 76.7 tokens a second and an AGX Thor reaches 226, and the authors put somewhere between 9,000 and 35,000 H100-equivalents of compute across roughly 9.5 million fielded units, only a fraction of which is reachable or vulnerable.

The defences they suggest are mundane: watch for device-to-device traffic between machines that would not normally talk at that volume, notify and quarantine infected subscribers, and keep default passwords off consumer hardware, which the UK now requires. For the Mirai botnet, notification plus quarantine cleared 92% of infections within 14 days, against 74% with no notification.

This is the same team that reported an open-weight model building a working exploit chain for $20.40 on October 1, and whose cyber access tier blocked none of 50 trials in its own test six days later.

The framing here is a signs-of-life result on hardware the team bought, not a worm loose on the internet. The headline figure stays 0.39 tokens a second across 15 boxes.

Note: Links to online stores in articles can be so-called affiliate links. If you buy through this link, MIXED receives a commission from the provider. For you the price does not change.