Anthropic ran a small AI model on $55 TV boxes. The enterprise lesson is about devices you already own

Fifteen off-brand Android TV boxes, about $55 each, with 4GB of memory apiece. Wired together, they ran a 26-billion-parameter open model at roughly 0.39 tokens per second. Slow, but working.

That setup sits at the center of research Anthropic’s Frontier Red Team published on October 12. William Zhou and Daniel Freeman asked whether small AI models could do something that has so far required a data center: find a device, copy themselves onto it, get inference running on unfamiliar hardware and repeat. Their warning is that “small AI models may be months away from being capable enough to self-replicate” on internet-connected devices.

What was shown, and what was projected

The findings come in layers of certainty, and they are easy to blur.

How far the evidence goes

Shown in the labProjected or untested

1. Inference on new hardwareA 9B model succeeded on 8 of 9 hardware types
2. Individual stepsModels of 30B or fewer complete many, but fail chaining them
3. End to end, simplifiedGLM-5.2 reached 8 of 8 nodes in 4 of 5 trials
4. Small models end to endProjected by end of 2026 on trend
5. Real-world break-inNot tested; exploitation kept trivial

Several details matter for reading it correctly. The exploitation step was deliberately trivial: devices with unauthenticated Android Debug Bridge ports. Replication was slow, with a doubling time of days. Giving the small models access to a much stronger model as an advisor did not significantly improve their setup success. And the projection to end of 2026 rests on a trend fit of a general capability index, which the authors call a rough proxy.

The adaptation result is the one to remember. When each generation of a Qwen3.5-9B replicator inherited notes from the previous one, setup success rose from 45% in the first generation to between 61% and 84% in later ones. “Unlike non-AI malware, it could also figure out unfamiliar devices on its own.”

Why this is an enterprise problem, not only an internet one

The paper frames the risk at internet scale: botnets of millions of consumer devices. Its compute estimate is modest, about 40 H100 equivalents across a two-million-TV botnet, “a tiny amount of compute in absolute terms.” The more immediate enterprise question is closer to home.

Corporate networks are full of devices that look like the test bed: meeting-room boxes, digital signage players, smart displays, cameras with on-device accelerators, developer boards on factory floors and in labs. Many run Android or embedded Linux, many were installed by facilities or operations teams rather than IT, and many have never had a security review. The paper estimates that NVIDIA edge devices alone hold between 9,000 and 35,000 H100 equivalents of compute, with the reachable and vulnerable share likely an order of magnitude lower or more. Some of that sits inside enterprises.

A replicator, the authors note, “would be challenging to shut down, since there’s no centralized point to shut off.” That is a different incident shape from the one most response plans assume, which is one compromised server or one misbehaving agent with an owner. We argued in stopping an agent is the easy part of an incident that the plan has to exist before go-live. For code nobody deployed, the plan is the network.

The defenses are old ones

Nothing in the paper requires new AI security products. It points to controls most security teams already know and many have not finished applying to the edge:

• Inventory AI-capable devices. Know which devices on your network have accelerators or enough memory to run a model, who owns them and what they run.
• Remove weak defaults. Default passwords and open debug ports were the way in. The authors cite the United Kingdom’s ban on default IoT passwords as the kind of baseline that shrinks the pool.
• Segment and watch device traffic. The authors note a trade-off that favors defenders: faster replication means more traffic. Multi-gigabyte transfers to new hosts and unusual device-to-device flows are visible to anyone looking.
• Quarantine and notify. In the Mirai cleanup the authors cite, quarantine plus notification cleared 92% of infections within 14 days, against 74% without notification.

There is also a procurement point. Devices with on-board AI accelerators are arriving through facilities and operations budgets, often outside security review. Adding “can this device run a model, and how is it locked down?” to the purchasing checklist costs nothing now.

The research is a warning about a capability that does not fully exist yet. The weak devices it depends on already do. The authors’ closing advice applies to enterprise networks as much as the internet: harden systems so replicators struggle to spread, and prepare for a world where they may persist.