Anthropic Tested AI Self-Replication on Cheap TV Boxes

Spreading artificial intelligence across a network does not necessarily require access to massive data centers or expensive GPU accelerators. Researchers at Anthropic have found that modern language models are already capable of performing some of the tasks required to launch autonomously on unfamiliar hardware. In the long term, this could allow AI to spread between standard consumer devices, creating decentralized networks that would be difficult to shut down.

How AI Self-Replication Works

Frontier Red Team researchers William Zhou and Daniel Freeman studied a scenario in which an AI autonomously deploys its own copies and transfers them to other devices without direct human intervention. This process is known as Autonomous Replication and Adaptation (ARA).

Previous studies have already demonstrated that AI agents can search for vulnerable nodes on a network, utilize discovered exploits, and transfer model files to other computers. In this new research, the Anthropic team focused on a different challenge: whether a model could autonomously prepare an environment to run on hardware it has never encountered before.

To achieve this, several technical tasks must be solved sequentially: identifying device specifications, selecting compatible software, choosing appropriate library versions, and configuring the execution based on available resources. Administrative privileges are not always necessary — some models can run within a standard user environment.

It is the combination of these capabilities that worries researchers. If an AI can adapt to different devices on its own, its propagation would no longer depend on a single hardware platform.

Cheap TV Boxes as a Testing Ground

To test the capabilities of modern models, the team purchased 15 inexpensive Android TV boxes for approximately $55 each. Instead of running the full model on each box, the researchers distributed its layers across multiple devices using pipeline parallelism.

The experiment used the Gemma4-26B-A4B model. This setup allowed the model to run on a group of low-power devices, although performance was low, at approximately 0.39 tokens per second. In other words, the experiment confirmed the technical feasibility of performing computations, but did not demonstrate high speed.

Such devices are of interest to security researchers due to their limited hardware resources and the varying quality of security features in different models. Some are equipped with only 1–4 GB of RAM, and the quality of software support and updates depends on the manufacturer.

As an example of an existing threat, the authors mention the Kimwolf botnet, which, according to the data cited in the study, infected over two million devices. This case shows how large-scale networks built on mass consumer equipment can become. However, it does not in itself prove that a similar scale is currently achievable for an autonomously spreading AI.

Which Models Passed the Test

During the experiments, the researchers tested how well models adapt to different hardware platforms. A 9-billion parameter model was able to configure itself on eight out of nine hardware types. The devices tested included the NVIDIA Jetson Nano, Mac computers, and systems with an RTX 4090 graphics card.

Separately, the team tested whether models could sequentially complete configuration steps on multiple network nodes. In a simplified scenario with eight devices where access via the ADB port was not required, the GLM-5.2 model performed best. In four out of five trials, it covered all nodes, and in the remaining case, it reached seven out of eight.

Other open-source models could not consistently complete the entire process. This indicates that having individual necessary skills does not necessarily mean the capability to organize full-scale propagation autonomously.

Results changed when researchers simplified the task by replacing complex configuration with a ready-made script. Under these conditions, even small models could perform a significant portion of the work: a 3-billion parameter model was able to traverse approximately half the nodes in a 17-device network.

The authors emphasize that these tests do not replicate a full-scale cyberattack. The experimental conditions were simplified, so the results reflect potential model capabilities under favorable circumstances rather than guaranteed behavior in a real-world network.

When Self-Propagating AI Might Become Reality

To assess the prospects of the technology, the researchers identified two limitations. The first is the minimum capability level required for a model to reliably perform the actions necessary for replication. The second is the maximum size of a model that can fit on an available device, given its memory and computing power.

Currently, these boundaries do not intersect: models capable enough to perform complex tasks do not always fit on weak hardware, and compact versions are not always able to reliably complete the entire process on their own.

The paper also examines the development trajectory of open-source models using the Epoch Capabilities Index. According to the authors’ assessment, the best open-source models up to 30 billion parameters add about 13.7 index points per year.

Based on this data, the researchers hypothesize that a model with capabilities comparable to those demonstrated by GLM-5.2 could appear by the end of 2026. However, this is an approximate forecast: the index used does not measure self-replication capability directly, so it cannot be considered an accurate prediction of when an autonomous AI botnet might emerge.

Why Such a Network Might Be Slow but Resilient

Experiments on actual TV boxes showed that autonomously preparing the environment to run the model takes significant time. For Gemma4-26B-A4B, the process took between 71 and 150 hours, while for Qwen3.5-9B, it took between 28 and 51 hours.

Such speed makes propagation much less efficient compared to traditional malware. Nevertheless, the researchers considered a hypothetical scenario in which such a mechanism gains access to a network on the scale of Kimwolf.

According to their calculations, about 133,000 copies of the model could appear in such a network. The combined computing power of these devices would be comparable to about 40 NVIDIA H100 accelerators. This is a negligible resource by the standards of large AI systems, but it shows that distributed computing is possible without centralized infrastructure.

The main problem is not so much speed as resilience. A decentralized network has no single server whose disconnection would guarantee the cessation of all processes. If some devices fail, the remaining nodes could potentially continue to function.

However, this scenario remains theoretical: the experiment did not demonstrate a full-fledged AI botnet that spreads autonomously in a real network and maintains functionality after being countered.

Can AI Improve the Propagation Process

Another feature studied by the Anthropic team is the transfer of accumulated experience between generations of models. In some scenarios, descendants could use notes left by previous copies to simplify configuration on new hardware.

In tests with Qwen3.5-9B, the success rate for launches increased from 45% for the first generation to 61–84% for subsequent ones. This suggests that retaining useful information can increase the efficiency of repeating the same technical operations.

At the same time, prompts from the more powerful Opus 4.8 model did not yield the expected results. The researchers interpret this to mean that simply passing on recommendations is not enough if a small model cannot correctly determine which questions to ask to solve a specific problem.

Therefore, the authors are considering the possibility of role division: a more powerful model could coordinate the work, while compact models perform individual operations on available devices. However, this is a possible scenario for technology development, not a confirmed scheme for an active network.

How to Defend Against Such Threats

Researchers believe that countering potential AI botnets should involve several approaches.

One of them is network monitoring. The transfer of large model files and intensive data exchange between devices can leave noticeable traces. Isolated research systems, or honeypots, will help provide additional information about propagation methods.

The second approach is the rapid detection and isolation of infected devices. The study cites the example of the fight against Mirai: according to the data mentioned, user notifications and restrictions for infected subscribers helped eliminate 92% of infections within 14 days, whereas without such measures, the figure was 74%.

Device security at the manufacturing stage also plays an important role. Specifically, the use of factory passwords that are easy to guess creates conditions for mass equipment infection. In the UK, safety requirements for consumer devices are already limiting such practices.