The box under your TV is the device in Anthropic's new self-replication research. On Monday, October 12, the Frontier Red Team said small AI models may be months away from copying themselves across cheap internet-connected gadgets, including smart ovens and off-brand Android TV boxes.
Anthropic left the hacking step trivial on purpose. The test used an Android debug port, ADB, with no authentication, so the model only had to find a machine, copy itself over, and get inference running. That open port is already a live path. Germany's cyber agency, the BSI, says ADB is enabled by default, with no authentication, on many cheap Android TV boxes. Synthient says that's how the Kimwolf botnet grew past 2 million devices, mostly TV boxes. The step Anthropic treated as trivial is the one already solved on millions of real boxes, so the box under your TV is where you can act.
The step Anthropic skipped is already solved
Anthropic bought 15 off-brand Android TV boxes at about $55 apiece, well under $1,000 of hardware, and ran Google's Gemma4-26B-A4B across them at 0.39 tokens a second. A 9B model got inference running on eight of the nine hardware types the lab tried. In an eight-node emulated Android network, only GLM-5.2, among the open-weight models tested, finished the full trip from node to node: all eight nodes in four of five trials, and seven of eight in the fifth.
GLM-5.2 was standing up a small Llama 3.1 8B model on each node, the worm's own model ran on a separate server, and the exploit step was trivial, so Anthropic calls the run an upper bound and says a full rogue replicator doesn't exist yet; Kimwolf itself is ordinary botnet malware, not AI.
On the historical trend of small open models, measured with the Epoch Capabilities Index, Anthropic's rough estimate is that a model of 30 billion parameters or fewer reaches GLM-5.2's level by the end of this year, with small weight-based replicators possible soon after. In a separate run, when each generation of Qwen3.5-9B inherited notes from the last, setup success rose from 45% to somewhere between 61% and 84%.
Here's how the gadgets Anthropic looked at compare, and which ones already have a criminal track record.
| Device class | Memory | Could it host a model? | Real-world track record |
|---|---|---|---|
| Off-brand Android TV boxes | 1 to 4GB RAM | At 4GB and 4-bit, four or more boxes for a 9B model, and 10 or more for a 26B model | Kimwolf passed 2 million infected devices, mostly TV boxes, through open ADB |
| Small-business NAS boxes | 512MB to 2GB soldered RAM | Similar to the TV boxes, so a model needs many of them | Ransomware and cryptojacking, which Anthropic notes via CISA and the NCSC |
| AI cameras and conferencing units with Nvidia Jetson chips | 64GB on a Jetson AGX Orin | One device can run a whole model | No mass compromise so far. Most reach the internet through outbound cloud tunnels |
| Mini-PCs and Orange Pi-type boards | Not specified | Capable | Mini-PCs are significantly more hardened, and Orange Pi-type boards are difficult to breach |
The TV-box row is where a simplified lab test and a criminal botnet describe the same door. The BSI also says some low-cost devices shipped with the malware already installed, and that operators have reached other devices on the same home network through commercial proxy services.
Slow, cheap and hard to kill
Anthropic estimates that a Kimwolf-sized fleet of TV boxes running the demo model would add up to at most about 40 Nvidia H100s' worth of inference, with a doubling time of days. Its phrase for that shape is a "digital slime mold," slow and stubborn, and small next to a real GPU cluster.
ISP monitoring would notice multi-gigabyte model downloads and steady traffic between machines that rarely talk. Quarantining infected subscribers worked against Mirai, where notification cleared 92% of infections in 14 days, compared with 74% when nobody was told. Anthropic also points to the UK, where default IoT passwords are now non-compliant.
Synthient's scans of one large residential-proxy pool found that 67% of the Android devices answered with no authentication, about 6 million vulnerable addresses, and that some boxes ship already infected. You can check an address at synthient.com/check. The FBI has a 2025 public warning on a different campaign, BADBOX 2.0, and the shopping clues overlap. Watch for TV streaming devices sold as unlocked or able to reach free content, unrecognizable brands, devices that aren't Play Protect certified, and apps from unofficial marketplaces.
If you own a no-name Android TV box, especially one sold as unlocked or for free streaming, check it on Synthient's page, turn off developer options and ADB, factory-reset it, and install the latest firmware. If the maker has stopped shipping updates, replace it. The BSI's advice is a current model from a reputable brand, and the FBI's list points you toward a Play Protect certified device. Put the rest of your smart-home gear on a guest network if your router supports one. Then watch whether small open models actually reach the capability bar Anthropic sketched by year's end, and whether ISPs and device makers pick up the defenses it names.
Photo: Oliwier Jaszczyszyn / Wikimedia Commons, CC BY-SA 4.0.
