The most arresting object in Anthropic’s experiment was not a supercomputer. It was a pile of fifteen off-brand Android TV boxes, each with 4 gigabytes of memory and a purchase price of about $55. The researchers split the layers of Gemma4-26B-A4B across the devices and produced text at 0.39 tokens per second. That is slow enough to make ordinary conversation painful, but fast enough to establish the physical point: a capable model can exist as a distributed process across cheap machines that were never designed to host it.[1][2]
That result is easy to retell as “AI spread itself across televisions.” It did not. The experiment was deliberately decomposed because a genuine weight-based replicator would need to solve several different problems: discover a target, gain access, transfer its software and weights, configure inference on unfamiliar hardware and then use the new copy to continue the chain. Anthropic showed progress on those components, not one autonomous rogue system completing them under realistic conditions.
Three experiments that should not be collapsed into one
What the research actually demonstrated
| Test | What ran where | Result | What it did not prove |
|---|---|---|---|
| Cheap-device inference | Gemma4-26B-A4B split across 15 physical TV boxes | 0.39 tokens per second | No model chose targets or copied itselfSource 1 |
| Hardware adaptation | A 9-billion-parameter model configured inference on unfamiliar devices | Working setup on eight of nine hardware types | No evidence of reliable autonomous propagationSource 1Source 3 |
| Simplified end-to-end spread | GLM-5.2 orchestrated propagation in an eight-node emulated Android network | All eight nodes reached in four of five trials; seven in the fifth | The orchestrator did not run on the cheap target devices and access was intentionally easySource 1Source 2 |
The end-to-end test is the most important and the easiest to misunderstand. GLM-5.2 was the only tested open-weight model that reliably completed the chain. It propagated a separate Llama3.1-8B inference setup across an eight-node test network. The access step used an unauthenticated Android Debug Bridge port, making compromise deliberately simple. Anthropic describes the result as an upper bound on real-world success, not a field test against normally secured consumer devices.[1][3]
The missing conjunction
A working autonomous worm needs two properties in the same system. It must be small enough to run on the hardware it captures, and capable enough to diagnose, install, recover from errors and continue without a remote intelligence doing the hard reasoning. In these experiments, the small models were close to the first requirement and could complete many individual setup steps. The model that reliably orchestrated the whole chain was too large to be the resident intelligence on the TV boxes.
Anthropic’s forecast that the two requirements could converge by the end of 2026 is an extrapolation from capability trends, not a scheduled event. The estimate matters because the remaining gap is no longer purely conceptual. Yet the security response should be grounded in the demonstrated weak points: remove default credentials, disable exposed debugging interfaces, segment low-trust devices, monitor unusual model-weight transfers and make compromised hardware easy to quarantine. Those controls are useful whether the attacker is an AI agent, a conventional botnet or a person with an automated toolkit.
The real lesson of the fifteen boxes is not that a machine intelligence escaped. It is that intelligence is becoming portable enough for the boundary between model, malware and infrastructure to deserve much more precise language.
Sources & further reading
- AI models may be capable of self-replicating without access to a datacenter Anthropic · 12 Oct 2026 · Accessed 16 Oct 2026
- AI models may soon self-replicate without access to data centers, Anthropic warns Reuters · 13 Oct 2026 · Accessed 16 Oct 2026
- Anthropic warns of self-replicating AI worm threat that does not need data centers Tom’s Hardware · 13 Oct 2026 · Accessed 16 Oct 2026