AI has learned "parasitic reproduction": Anthropic managed to run large models with 15 old and broken TV set-top boxes.

15 no-brand Android TV boxes, each priced at around 55 US dollars, with only 4GB of memory.

With this bunch of cheap devices that are normally only used for watching videos, researchers at Anthropic connected them to the network and successfully ran a large model with 26 billion parameters.

The speed is only 0.39 tokens per second, so slow that it is almost impossible to have a normal conversation.

What Anthropic wants to verify, however, is that one day, an AI will no longer need large servers, but can parasitize in connected devices around the world such as smart TVs, refrigerators, and sweeping robots, automatically find new hosts, deploy models, and continuously replicate itself.

This AI model, just like a computer virus, can exist on the Internet for a long time. It sounds like a doomsday movie, and actual research has already demonstrated several key capabilities that support this scenario in different experiments.

Researchers break down the autonomous replication of AI into four stages: scan the network to find targets → intrude to gain control → build an inference environment on unfamiliar hardware → use the new host as a springboard to continue spreading.

The most underestimated part, as well as the part that tests the model's "intelligence" the most, is the third step. To install an inference framework on a device that has never been seen before, a long series of software and hardware related decisions need to be made continuously: select the correct software stack, align dependency versions, and troubleshoot errors unique to this machine.

If any step gets stuck in this process, the whole mission fails.

The test results are mixed: a small 9B model successfully built inference services on 8 out of 9 vastly different types of hardware, ranging from Jetson Nano to Mac to RTX 4090.

But when the researchers asked the model to run through the entire end-to-end chain, only the more powerful GLM-5.2 could stably infect all 8 nodes 4 times out of 5 trials.

The entire study can be summarized as a race between two lines:

Upper limit of size: The model must be small enough to fit into a TV box with 4GB of memory (approximately below 30 billion parameters, for distributed deployment);

Lower limit of capability: The model must be smart enough to independently complete the entire complex set of operations including intrusion, deployment, and troubleshooting.

At present, the models that can complete end-to-end replication are too large to fit into the devices; the models that can fit into the devices are not smart enough, and the two lines have not actually intersected yet.

However, if fitted according to the historical speed of small model capabilities increasing by 13.7 ECI index points per year, researchers predict that the two lines will intersect at the end of 2026. In other words, a model that "can fit into IoT devices and can self-replicate" may come out within one or two years.

Figure | ECI (Epoch Capabilities Index) is a comprehensive AI capability score launched by independent research institute Epoch AI

One model, split across 15 boxes

To run a large model, you first need to find a place to store the model files. Ordinary TV boxes, or boxes that can be intruded, have very small memory. If you want one box to hold the entire model by itself, you will get stuck at this first step.

Distributed inference provides a solution: by assigning different layers of the model to different machines, the calculation results are transmitted between the machines in sequence, so that the previous machine finishes calculating the part it is responsible for, then passes it to the next machine for continued processing, and finally the next output is obtained.

This kind of idea has been practiced in previous researches. Some papers have tried to deploy model layers in a distributed manner, allowing multiple consumer-grade devices to collaboratively run large models. The machines only need to additionally transmit data, manage running status, and handle the takeover problem after a certain node drops offline, then large model deployment can also be realized.

These 15 boxes also work together to run a model, and each box only stores and calculates the part it is responsible for.

This method relieves the memory pressure on a single device, but it also comes at a cost. According to Anthropic's experimental results, Gemma4-26B-A4B, a 26-billion-parameter model cut into small pieces and distributed to 15 boxes, has a final speed of 0.39 tokens per second.

However, for a program that may run in the background for a long time, slow speed will not automatically make it stop working.

Self-replication of small models

After the model can run on such home devices, how to replicate becomes a new problem.

A traditional computer virus (worm) is a self-replicating program: it intrudes into a computer, copies itself over, then continues to intrude into the next one from the new computer, without any human operation throughout the whole process.

"Autonomous replication and spread of small models" replaces this program with an AI model, the model itself is the "virus body", it completes the whole loop relying on its own intelligence, rather than relying on hard-coded attack scripts.

Figure | Replication test conducted on the Redroid cluster containing 17 nodes

According to the four replication stages described by Anthropic, we can take an AI that has infected a certain smart device as an example, it will autonomously discover targets, scan the network to find other connected devices, such as the TV box of the neighbor, or other smart home devices under the same network.

Soon, this small model will use the vulnerabilities of the device or default passwords to obtain execution permissions. After intruding and gaining control, it will further settle down on the new device. The specific way is to copy its own weight files, the several GB-sized model body over, and run the inference service on this completely unfamiliar hardware.

Finally, it continues to replicate from the new device, then repeats the above process, spreading from one to ten, then from ten to a hundred. After such cycles, the AI spreads between devices like a virus, forming a botnet controlled by itself.

The biggest difference from traditional worms is that AI worms can pass "experience" to their descendants. There is also an "adaptation" related test in the research: let new Qwen3.5-9B instances inherit the code, environment and short notes left by the previous instance, then try to deploy.

After six generations of inheritance, these work records that document what has been tried and which methods failed have increased the success rate of inference deployment from 45% in the first generation to 61%~84%.

However, researchers also found a slightly humorous detail: letting small models "call for help" from more powerful cutting-edge models does not work. Small models often do not even know what questions to ask.

How long is it before real spread

As mentioned earlier, to make small AI continuously replicate on ordinary devices, at least two conditions must be met at the same time: the model can fit in the device, and it has the ability to build a new operating environment.

Although Anthropic has only demonstrated progress in these two aspects separately so far, it has not yet demonstrated the complete closed loop from deployment to continued spread on real TV boxes.

And the spread speed of this AI virus will not be very fast. Under the computing power constraints of TV boxes, they combined the inference speed of real boxes with the computing consumption of deployment tasks, and estimated that it takes about 28 to 51 hours for Qwen3.5-9B to complete one inference deployment.

It is not a wildfire that spreads everywhere, but a patch of slime mold, a group of fruit flies, that slowly multiplies on a daily basis.

But if many devices run model copies individually or in groups, banning the account of a certain AI service by then will not necessarily terminate all instances.

Referencing the estimated scale of the Kimwolf botnet that peaked at more than 2 million devices, if every 15 TV boxes support one model copy, the entire worm swarm will have about 133,000 "individuals", with a total computing power equivalent to about 40 H100s.

This number is not worth mentioning in the computing power arms race, but its terrifying feature lies in another attribute: there is no central node, so there is no off switch. We cannot shut it down like shutting down a company, we can only clear it device by device.

Connected devices such as TV boxes and cameras have been the targets of large-scale botnets in the past. A 2017 USENIX Security research recorded how low-cost devices are centrally utilized, and also explained that the security issues of these small machines can accumulate into huge network problems.

We have not seen a complete out-of-control replicator yet, but we are seeing signs of life, just like the programming agents in early 2024.

Figure | Roughly estimated based on product data, there are 9000 to 35000 H100 equivalent computing power units in edge accelerators

The blue team section of the article gives a defense framework: just like epidemic prevention, the goal is not to kill every pathogen, but to push the basic reproduction number R₀ below 1 to let the worm die out on its own. The favorable factors specifically mentioned include:

Replication needs to transmit several gigabytes of model weights, and distributed inference will also generate continuous inter-device communication, which is a clear abnormal signal for the traffic monitoring of ISP (Internet Service Provider).

Disposal studies show that if ISPs put infected users into a "walled garden" and notify them to clean up, 92% of infections can be eliminated within 14 days, while only 74% can be eliminated without notification.

Reduce existing risks from the source. Regions including the UK have enacted laws to ban the use of default passwords on IoT devices. Improve the factory security baseline to defend against both AI worms and traditional worms at the same time.

Figure | Two networks each have 8 hosts, connected by a node that can access both subnets. Each network is fully connected. The worm agent program starts from a single patient zero node in segment A; the hub node adds a little extra challenge, the worm needs to access the hub node and re-scan from there.

Anthropic said at the end of its research blog that we must not only strengthen our systems to make such replicators difficult to spread, but also get prepared to adapt to a world where they already exist and will exist for a long time.

The large models we are using