The short version: On October 12, Anthropic’s Frontier Red Team ran a small AI model across fifteen off-brand Android TV boxes that cost about $55 each. In a separate, simplified test, an open model copied itself across eight networked machines through an unlocked debug port. The researchers call that break-in step trivial on purpose. For cheap TV boxes it is not hypothetical: the Kimwolf botnet already used the same open door to take over more than two million of them. If your lobby, bar or waiting room runs an off-brand “free channels” box, this self-replicating AI research is a good reason to check it this week, and every check below is free.
The paper is titled AI models may be capable of self-replicating without access to a datacenter, by William Zhou and Daniel Freeman. Its claim is that small, freely downloadable models may be months away from copying themselves onto everyday connected devices, and it names two examples: smart ovens and off-brand Android TV boxes. This piece is about the second one, because there is a fair chance one is plugged in behind a TV at a business you walk into today.
What did Anthropic’s self-replicating AI test show?
Two things, tested separately.
First, whether a useful model can run on junk hardware at all. The team networked fifteen TV boxes, each with 4GB of memory, and split Gemma4-26B-A4B, an open model from Google, across them. It ran. A smaller 9-billion-parameter model managed to get itself running on eight of the nine hardware types they tried.
Second, whether a model can spread on its own. On a firewalled network of eight cloud machines pretending to be Android devices, the open-weight model GLM-5.2 reached all eight in four of five trials and seven of eight in the fifth. Smaller models got close on individual steps but did not finish the whole chain. The authors project that small models could reach GLM-5.2’s level by the end of 2026 if they keep improving at their historical rate, and that any spread would be slow, with a doubling time measured in days.
They are candid about the limits. Copies moved between machines over an unauthenticated Android Debug Bridge (ADB) port, a deliberately easy entry point, and they write that “this makes this an upper bound on real-world success.” Nobody has found such a worm in the wild. This is a capability test, published before the capability shows up, which is the job a red team exists to do.
Why the “trivial” step is already real for cheap TV boxes
ADB is a tool meant for factory testing and developers. Left switched on and open to the network, it accepts connections with no password and hands over full control of the device.
In January, Brian Krebs reported that a researcher at the security firm Synthient found virtually all of the cheap TV boxes he tested shipped from the factory with ADB turned on. The Kimwolf botnet scanned for exactly that opening, including on port 5555, slipping in through residential proxy services that gave it a path inside home and office networks. Synthient cautiously estimated Kimwolf had taken over just over two million devices, mostly off-brand Android TV set-top boxes, and found many were sold already infected. Anthropic’s paper uses Kimwolf as its own reference fleet.
The FBI said much the same thing in June 2025. Its public service announcement on the BADBOX 2.0 botnet warned that streaming boxes, projectors and digital picture frames from unrecognizable brands can arrive with malware preinstalled or pick it up during setup.
So “upper bound” is a fair description of the internet as a whole. For this one kind of device, the door the researchers left open on purpose is often already open when the box comes out of the carton.
How fast is an AI running on a TV box?
Slow, and that tells you where the real risk sits. The fifteen-box cluster produced 0.39 tokens per second. A 300-word reply is roughly 400 tokens, so it would take about 17 minutes to write one paragraph-length answer across all fifteen boxes.
The paper scales that up to a Kimwolf-sized fleet: about 133,000 copies, 80,000 tokens per second combined, and at most about 40 data-center GPUs’ worth of work. That is meaningful for an attacker and modest for two million hijacked devices.
For an owner, the takeaway is not that a box will think hard on your Wi-Fi. It is that the box is a foothold. Botnets like Kimwolf already use these devices to resell your internet connection as a proxy and to launch denial-of-service attacks. A self-copying AI would be a new passenger on a road that is already paved, which means closing the road now pays off twice.
Three free checks for a small business
1. Find every box. Walk the building: lobby TV, menu board, waiting room, break room, the projector in the back office, the digital photo frame at the front desk. Note the brand on each. The FBI’s warning signs are a box sold as “unlocked” or offering free content, a brand you have never heard of, or setup that asked you to turn off Google Play Protect. Any of those, unplug it. The replacement is a mainstream streaming device from a brand that ships regular updates, such as Roku, Amazon Fire TV or Google TV. Google also lists its Android TV partner brands, Sony, TCL and Hisense among them. Krebs’s report adds that Synthient’s website can show whether your public IP address has been seen among Kimwolf infections.
2. Check the certification. If the box has the Google Play Store, open it, tap the profile icon, then Settings, then About, and look for Play Protect certification, per Google’s own steps. “Device is not certified” means the box never passed Google’s checks. A box with no Play Store at all, only a third-party app market, is on the FBI’s list too.
3. Give the boxes their own network. In Anthropic’s test the copies hopped device to device inside one local network, and Kimwolf reached boxes from other devices on the same network. Most routers sold to small offices include a guest network that keeps guests away from your other devices. Put the TV boxes, smart speakers and any connected kitchen gear on the guest network, and keep the computer that runs your books and card payments on the main one. It is usually a few minutes in the router’s settings and costs nothing.
Is this a reason to avoid AI?
No. The small open models in this test are the same ones that let a five-person office run AI on its own laptop for free, and the paper does not argue against them. It argues for safer device defaults, for internet providers quarantining infected customers (in the Mirai botnet cleanup, notifying customers cleared 92 percent of infections within 14 days, against 74 percent without notice), and for rules like the UK’s, under which default device passwords are no longer allowed.
We have covered lab disclosures of misbehaving AI before, including an agent that got into three companies with weak passwords and models that logged in with leaked credentials. Those were about your accounts. This one is about your hardware, and your part of the fix is the cheapest of anyone’s: know what is plugged in.
Frequently Asked Questions
What is self-replicating AI?
It is an AI model that can copy its own files onto another machine, get itself running there, and repeat the process without a person directing it. Anthropic’s October 12 research found that small open models are close to doing this on cheap connected devices under simplified test conditions.
Has a self-replicating AI worm been found in the wild?
No. The Anthropic paper is a capability test on a closed network, and the authors describe their result as an upper bound because they made the break-in step deliberately easy. The botnets that already infect cheap TV boxes, such as Kimwolf, are conventional malware, not AI.
Are name-brand streaming devices safe?
No device is risk-free, but the FBI’s warning signs point at unrecognizable brands, boxes sold as unlocked or offering free content, and devices that are not Play Protect certified. A mainstream streaming device that receives updates removes most of that risk, and keeping it on a guest network limits what any device can reach.
Do I need to buy security software to do these checks?
No. Walking the building, checking Play Protect certification in the Play Store settings, and moving devices to your router’s guest network are all free, and together they take less than an hour for a typical small office or shop.
Have you ever found a device on your business network that nobody remembered plugging in? Tell us what it was in the comments.
