Anthropic’s red team ran AI on 15 cheap TV boxes. Then the math got unsettling.

Anthropic's red team discovered that self-replicating AI worms might become feasible within a couple of years. They built a 15-box cluster from cheap Android TV boxes for $825 and showed that smaller AI models can already handle most of the technical steps needed to spread themselves: finding targets, gaining access, running inference, and moving to the next machine. The real bottleneck isn't exploitation—models like Qwen3.5-9B already handle basic hacking tasks. The hard part is getting unfamiliar hardware to work. When the team tested GLM-5.2, it successfully deployed inference servers on eight out of nine different hardware types, ranging from Jetson Nanos to Mac machines. In a controlled environment with eight networked Android emulators, GLM-5.2 reached all eight nodes in four out of five trials, spawning fresh copies whenever it established a working server. The researchers identified a critical gap: right now, models either have the capability to replicate reliably but are too large to run on cheap devices, or they're small enough to fit but can't complete the process consistently. Using capability trend data, they project that by the end of 2026, open-weight models with 30 billion parameters or fewer will reach the competence level needed. Their 15-box cluster runs Gemma4-26B-A4B by distributing weights across multiple machines, and they estimate a single setup takes 28 to 150 hours depending on the model. The team also noted something unsettling: lightweight AI agents would be far more patient than human attackers. They'd grind through setup failures across thousands of devices without complaint, spreading like "a digital slime mold." Using the Kimwolf botnet's infection of two million Android TV boxes as a baseline, they calculated that an equivalent network could generate 80,000 tokens per second—the computing power of roughly 40 H100 GPUs—while the electricity and hardware costs belonged to someone else. Stopping such a worm wouldn't be impossible but would require coordination across multiple ISPs. Moving multi-gigabyte models between devices creates detectable network traffic, and aggressive spreading wouldn't stay hidden. During the Mirai botnet cleanup, a single ISP's quarantine cleared 92% of infections in two weeks, suggesting that approach could work as an initial defense. Complete elimination, though, means every ISP with infected customers would need to act together—a coordination problem that gets harder the larger the outbreak becomes. The researchers emphasize they haven't built a working internet-wide worm, and their experiments used shortcuts that made replication easier. But they're saying the remaining barriers are mostly technical problems that will likely solve themselves as models get better.