Anthropic says a small model on cheap TV boxes is not yet a worm
The Frontier Red Team ran a split model on fifteen Android TV boxes and watched one larger model copy itself on a closed test network. The "months away" line is a projection.
On 12 October 2026 Anthropic's Frontier Red Team published a warning that small models may, within months, copy themselves across cheap internet-connected devices. Ars Technica and SecurityWeek reported the experiments the same week. The phrase Anthropic uses for the thing it has not built is a small weight-based replicator: a program that carries model weights, adapts to hardware it has not seen, and has no single switch that turns the whole spread off.
What the team demonstrated is narrower than that sentence. It bought fifteen off-brand Android TV boxes, about $55 each, with 4 gigabytes of memory. Split across them, Google's Gemma 4, a 26-billion-parameter model, produced output at 0.39 tokens a second. A separate 9-billion-parameter model, Qwen3.5-9B, got an inference server running on eight of the nine kinds of hardware in the test. Running is not spreading. A model that can be hosted on a weak device is a different result from a model that can find the next device and move.
The full cycle, and the step they skipped
On a closed network of eight emulated Android devices, only Zhipu's GLM-5.2 completed a full hop from one machine to the rest, reaching all eight in four of five runs. The other open models in the test managed pieces and failed the chain. Anthropic kept the break-in trivial, through an unauthenticated debugging port. The company treats the result as an upper bound on what would happen against real devices, not as a worm already loose. GLM-5.2 is also too large for one of those TV boxes. The small models fit the hardware and fail the trip. The large model makes the trip and does not fit.
The "by the end of 2026" line is Anthropic's trend, not a date on a calendar anyone else has signed. The researchers say models of about 30 billion parameters and under already do individual steps and stumble when the steps have to be one job. If that gap closes at the rate they plotted, a small model reaches GLM-5.2's level on this task before the year is out. A projection with the exploit step removed is a reason to watch the next paper. It is not a count of infected ovens.
Source: Ars Technica