Anthropic’s Frontier Red Team published a report on 12 October that is written very plainly and sticks with you anyway. The finding: small AI models may be only months away from spreading on their own, with no datacenter involved. On smart ovens. On cheap Android TV boxes. On the devices nobody ever patches.
Fifteen TV boxes, two model layers each
William Zhou and Daniel Freeman bought 15 off-brand Android boxes at roughly $55 apiece, networked them, and spread Gemma4-26B-A4B across them. Each box holds two layers of the model, split by pipeline parallelism. It runs: 0.39 tokens per second. With 4GB of RAM and 4-bit quantization, four devices are enough for a 9B model and ten for a 26B one.
Then comes the real question. Can a model walk the whole chain by itself? Find a target, get execution, copy the weights over, stand up inference, move on from there. The pair built a firewalled setup of eight cloud nodes running Android emulators, starting from a single infected node. Of the open-weight models they tested, exactly one managed the full chain: GLM-5.2, and it did so reliably, reaching all eight nodes in four of five trials.
I wrote about GLM-5.3 writing exploits without guardrails back in September. Now its predecessor is the yardstick for self-replication.
Two lines that haven’t crossed yet
Anthropic frames the problem as a floor and a ceiling. The floor is the capability a worm needs to complete the chain reliably. The ceiling is the model size that will actually run on the device it attacks. GLM-5.2 sits above the floor; Qwen3.5-9B and Gemma4-26B-A4B sit under the ceiling. The two don’t meet yet.
Extending the trend line is the uncomfortable part. Open models under 30 billion parameters gain 13.7 points per year on the Epoch Capabilities Index. On that math, a small model reaches GLM-5.2’s level by the end of 2026.
A slime mold, not a blitz
A worm like this would be slow. A full inference standup takes Gemma4-26B-A4B 71 to 150 hours, Qwen3.5-9B 28 to 51. The Kimwolf botnet peaked above two million devices, mostly Android TV boxes. A fleet that size would yield roughly 133,000 copies and 80,000 tokens per second, about the inference of 40 H100s. Anthropic’s own comparison is a slime mold: spreads over days, hard to grab, no off switch.
And it learns on the way. In one experiment each model instance passes its notes to the next. Success at standing up inference climbs across six generations from 45% to between 61% and 84%. Asking a stronger model for help does nothing, though. Qwen3.5-9B was given access to Opus 4.8 and got no measurable benefit. Small models don’t know what to ask.
The countermeasure is unglamorous
What works sounds like epidemiology: push R₀ below 1. Multi-gigabyte model payloads moving between televisions leave a traffic signature that ISPs can spot. With Mirai, quarantine plus customer notification cleared 92% of infections in 14 days, against 74% without notification. Add manufacturers dropping default passwords, which the UK now requires.
So no new tool, no AI shield. Defending against autonomous models looks like botnet cleanup circa 2016, only against an adversary that can adapt to hardware it has never seen. Anthropic calling this “signs of life” is the most honest phrase in the whole report.