Anthropic's Red Team Proved a $55 IoT Worm Can Run Inference

Anthropic’s Frontier Red Team published “Self-Replicating AI Without Datacenters” on Oct 12, 2026, with two empirical demonstrations that, read together, change what an “AI threat surface” means. The team sharded Gemma4-26B-A4B across 15 off-brand Android TV boxes at roughly $55 per box, ran inference via pipeline parallelism at 0.39 tokens per second, and showed that Qwen3.5-9B could configure other small LLMs to run on 8 of 9 hardware types tested, with no operator in the loop. They didn’t demonstrate a worm. They demonstrated the substrate a self-replicating worm would need — at a price point that fits inside a curbside pile. (Anthropic, Ars Technica, Unite.AI, Quartz, XenoSpectrum)

The lede detail is the hardware. The boxes are not bespoke AI silicon — they’re commodity Allwinner/H616-class Android TV sticks with ~4 GB of RAM, the kind that ship in a plastic blister at a warehouse store. Gemma4-26B-A4B at full precision doesn’t fit on a single box; sharding across 15 yields 0.39 tok/s, which is glacial for a chatbot but sufficient for batch tool-use workloads, automated reconnaissance, and the kind of low-throughput decision-making a self-replicating infection actually needs. “Slow” relative to a datacenter is not the same as “too slow to do harm.”

Demo 1: 15 boxes, 0.39 tokens per second

The first demonstration was a feasibility study, not a threat. The team took Gemma4-26B-A4B — a 26-billion-parameter model with an active-parameter count in the low single digits (the “A4B” architecture) — split the weights across the 15 boxes via pipeline parallelism, and ran end-to-end text generation. (Ars Technica, Anthropic)

The point of the exercise is not throughput. The point is that the inference path doesn’t require a datacenter, a GPU cluster, or any supply-chain dependency past what already exists in a working e-waste pile. Each box individually is unremarkable. Aggregate, on a consumer LAN with a smuggled-in coordinator, they’re a model host.

The boxes also have Wi-Fi, Bluetooth, and USB OTG out of the box. They’re network-attached, addressable, and have the kind of Linux-root-with-effort posture Mirai exploited six years ago. The Mirai botnet drove record-breaking DDoS by infecting approximately 600,000 IoT devices at peak. The economic unit of AI capacity — a $55 box — is now smaller than the economic unit of Mirai’s recruiting problem.

Demo 2: Qwen3.5-9B autoconfigure on 8 of 9 hardware types

The second demonstration is the one that does most of the work in the paper, because it shows a model doing the deployment work that an operator would normally do. Qwen3.5-9B, an open-weight 9-billion-parameter model, was given unfamiliar target devices and asked to figure out how to run inference on them. It succeeded on 8 of 9 hardware types tested. (Unite.AI, Quartz)

This is a different threat primitive. In a traditional worm, the malicious code has to be told what to do on every new target it encounters. In Qwen3.5-9B’s demonstrated behavior, the worm carries an inference engine that adapts to the target. The 1-out-of-9 failure is interesting on its own: it implies the agent’s competence ceiling is now the limiting factor in infection breadth, not the worm author’s payload engineering.

Ars Technica’s coverage notes the team explicitly avoided paying for any of the 8/9 successful configurations with a destructive terminal-payload test; this was a setup-the-inference exercise, not an infect-this-and-pivot exercise. XenoSpectrum’s third-party coverage goes further and reports that a GLM-5.2 variant completed a simplified replication chain in a lab setup — but the lab environment is materially different from the IoT demo and the methodology details are not in the Anthropic paper, so the figure should be treated as cross-reference evidence at best, not a reproducible end-to-end milestone. (Ars Technica, XenoSpectrum)

The ARA threat model

Anthropic frames the threat as Autonomous Replication and Adaptation (ARA), with four stages:

Stage	Action	Status (per Anthropic)
1	Find a target — scan networks, enumerate devices, identify candidates	CyberGym, ExploitBench, and worm-adaptation papers already document the techniques
2	Gain execution — exploit a vulnerability or use a leaked credential	Same tooling exists today, off-the-shelf
3	Establish inference — get a model running on the new host	Where the 15-box / 8-of-9 demos sit
4	Continue propagation — repeat from the new foothold	Capability-curve problem; the paper’s ECI projection places this within reach by year-end 2026

The team publishes a measured Effective Competency Index (ECI) — a rolling benchmark of replication-stage success rates — and projects that small-model self-replication would arrive at full integration by year-end 2026, given current capability gain rates. That projection is Anthropic’s own statistical extrapolation, not an observation. Read it as their forecast, not as a calendar invite. (Anthropic, Unite.AI)

What the projection actually says — and what the press has been sloppy about separating — is that stage 3 is no longer the bottleneck. Stages 1, 2, and 4 have been individually demonstrated in other work for years. What Anthropic adds is a yardstick for how long until they’re demonstrated end-to-end in a single integrated model, and a hardware substrate ($55 boxes) that makes the yardstick less reassuring than the labs are used to.

Why the old IoT-botnet playbook doesn’t apply

The defensive reflex is to point at Mirai’s takedown — sinkhole the C2, reach the registrar, get the botnet’s command infrastructure revoked. That playbook assumes the worm is dumb. A weight-based replicator isn’t. The model is the worm’s payload and its own configuration engine. Three consequences fall out:

1. No centralized kill switch. A weight-based replicator can carry its model locally or re-download from a public hub (Hugging Face, ModelScope). Sinkholing the C2 doesn’t kill the model that’s already on the box. Microsoft’s call this week for frontier-kill-switch requirements (TopClanker, Oct 15) is a deployment-side control; it has nothing to grab onto when the “deployment” is a $55 box’s flash memory.

2. The infection is “digital slime mold”-slow. Spread out across 0.39 tok/s endpoints and unfamiliar hardware, a real-world worm would move at the speed of consumer LANs, not the speed of botnets hammering a single target. Days-to-double, not minutes-to-double. The slow infection rate is a defense — but only against defenders expecting the Mirai signature (high-rate DDoS, single target, single vector). It’s no defense against defenders trying to spot a quiet 0.39-tok/s node in their router’s DHCP table.

3. Takedowns can’t keep up with adaptation. Qwen3.5-9B’s 8-of-9 demonstration is the empirical proof: the agent’s competence ceiling is what’s now driving infection breadth. A defender who patches one stack today is buying time against today’s model. The next generation of weights will read the patch note and try a different approach — automatically.

What actually follows from this

Three things:

First, the threat surface everyone is worried about is now demonstrably wrong. The frontier-AI-in-a-datacenter scenario drove the past two years of policy work, from Microsoft’s kill-switch call to the UK AI Bill to Anthropic’s own responsible scaling policy. None of those policy instruments reach a $55 Android TV box. The post that should scare enterprise security teams is not “GPT-6 jailbroken” — it’s “Gemma4-26B-A4B sharded across the venue’s conference-room TVs.”

Second, the “open weights are the threat” framing is also wrong, and Anthropic knows it. Both demos used open-weight models (Gemma4-26B-A4B, Qwen3.5-9B). The threat primitives — pipeline parallelism on cheap hardware, auto-configuration of unfamiliar targets — work with any open-weights model. Closing the weights would not close the demo; it would only close the auditable version. The defensive surface is the hardware and the network, not the model release pipeline.

Third, the year-end 2026 projection is the part to watch, not the part to dismiss. Anthropic is publishing the ECI because the lab’s projection is that small-model replication clears the capability threshold within months. If it does, the blog post about this won’t be the news — the news will be the first IoT-botnet fingerprint carrying a small-LLM payload and behaving differently from Mirai. The right triage posture now is the one that treats “AI-shaped traffic on consumer IoT subnets” as a category, not the one that treats “frontier-model deployment” as the priority. That pivot has not yet happened in the defender ecosystem. The Anthropic paper is the warning shot.

Sources: